Monday, 22 November 2010

The Conspirators and the "Conspiracy Phones"

This previous post raises an interesting question regarding quite how the four accused men had avoided detection to such an extent that the security services had no idea of their alleged plans. What with travel tickets, handwritten documents laying their plans bare and receipts recovered both from the homes of the accused and the Alexandra Grove 'bomb factory', their behaviour suggests that these men were not in the least bit concerned about their alleged plans being discovered yet the narrative tells us 'Khan was worried about being under surveillance during this time.

'This time' plainly refers to the supposed planning of the events of 7/7, since just above this statement, it is also written,
Other things suggest discipline and meticulous planning with good security awareness including careful use of mobile phones and use of hire cars for sensitive activities associated with the planning of the attacks.

The 'careful use of the mobile phones' was explored on the 4th day of the inquests during the testimony of DS Mark Stuart of Counter-terrorism command. DS Stuart confirmed that 'a certain number' of phones were recovered. What we also discover from DS Stuart, is that the police referred to the phones the accused men were using that day as 'operational phones' (as opposed to their personal phones) - which Mr. Hugo Keith QC later interchanges with the intriguing term 'conspiracy phones'.

These phones are claimed by DS Stuart to have been a way to 'avoid detection' by being changed on several occasions:
A. [DS Stuart] There were a series of operational phones. The earliest operational phones began in May, the middle of May, 2005, sir.
Q. [Hugo Keith QC] How many times were the phones switched or how many times were a new set of operational phones introduced into their usage?
A. For three of the subjects, four times, you're looking at data for the last, fourth, operational phone. For Lindsay, there were three, sir.
DS Stuart confirms later in the proceedings that the total number of 'conspiracy' phones used by the men was 15. One could argue that if a phone is changed four times, as three of the men are alleged to have done, this equates to five phones in total each - meaning that with Lindsay's four phones, the total amount of changes stated equates to 19 phones. This may seem a trivial point, but it is indicative of the confusing nature of DS Stuart's testimony. Another example of this is his account of the recovery of Khan's 'conspiracy' phone:
Q. In particular, investigators found in the wreckage a phone subsequently determined to belong to Khan?
A. That's correct, sir, yes.
Q. When that phone was examined, did it have any readable data on it?
A. No, sir, it was damaged beyond --
Q. Officer, could I ask you to keep your voice up a bit?
A. Sorry. No, it was too damaged to recover data from.
Q. So when that phone was examined, it wasn't possible to extract any relevant information from it?
A. No, sir.
Q. Was there also recovered from the Russell Square tunnel a phone subsequently determined to belong to Lindsay?
A. Yes, sir.
Q. When that phone was recovered, was it found to have information on it?
A. It was, sir, yes.

So very early on, we find that no data could be extracted from Khan's phone, which was recovered from the Edgware Road site, due to the damage it sustained. The implication thereafter is that the only way any data relating to Khan can be examined is through looking at incoming calls or texts on the other phones recovered from the day, in particular, the phone attributed to Lindsay, from which information had been extracted. However, a little later in his testimony, DS Stuart seems to contradict his earlier statement:
Q. Could I just run very briefly through why you are so sure that these phones relate to these people? In relation to Khan and his operational phone ending 254, were there a number of pieces of evidence which demonstrated that that phone was indeed his?
A. Yes, sir.
Q. Could you very briefly, please, summarise why that conclusion was reached?
A. The handset for that phone was discovered at the Edgware Road scene where Mohammed Sidique Khan's body was recovered. DNA from Mohammed Sidique Khan was recovered from the handset as well. The phone was routinely cell-sited in and around his home address. It was cell-sited in Luton on the 7th where we know from CCTV Mohammed Sidique Khan was. It only ever rang the other three. It was never rung by another number attributed to Mohammed Sidique Khan. That was the principal evidence, sir.

How could this data regarding Khan's phone be known if it wasn't extracted from the phone which DS Stuart had earlier stated 'was too damaged to extract data from'? DS Stuart does not enlighten us to any alternative method used to gain access to the phone's data.

Curiously, DS Stuart never states whether or not Shehzad Tanweer's phone was also recovered in the same way as the other three, at the scene of the explosion at Aldgate. We should note claims by both the narrative and Hugo Keith QC in his opening speech to the Inquests, that Tanweer had lost his mobile phone on the evening of 6th July, during a game of cricket.

However, DS Stuart confirms that a call was made at 00.03.59 on July 7th 2005, from Khan to Tanweer. If Khan's phone is too damaged, then we must assume that this particular data came from Tanweer's phone. But Tanweer lost his phone on the evening of July 6th ; we cannot know if it was his personal or 'conspiracy' phone, we cannot know if he or someone else - found it, and cannot know if a phone attributed to him was found at Aldgate. We further cannot know from which phone this information was extracted as we are not privy to the contact schedule cited by DS Stuart.

When explaining how the 'operational' number for Tanweer was attributed to him, DS Stuart tells Mr. Keith:
This was a number which was provided by Shehzad Tanweer on the rental agreement for the Nissan Micra subsequently left at Luton train station. Again, it was only rung by the other three and not by Tanweer himself. Generally cell-sited in the area of his home address.

So in contrast to the identification of the other three phones, which occurred due to their being recovered from the respective blast sites, Tanweer's 'conspiracy' phone number is identified because he provided it to the car hire company which supplied the Nissan Micra. Why should this be?

The car hire company provides another example of contradicting the idea that attempts were made by the men to avoid detection; Tanweer provided the First 24-Hour Car Rentals Limited with his family home address, confirmed in the statement of an employee of the company who called round to the Tanweer home when the car had not been returned as agreed.
By today, Tuesday, 12th, I was very concerned at the whereabouts. I decided to visit his home address and I went to the vicinity of the address and I saw a police cordon. Having explained why I was there I then provided the rental agreement.

In another statement, it is revealed to the Inquests that another First 24-Hour Car Rentals employee had attempted to contact Tanweer on 7th July, despite the fact that his rental agreement was until 8th July. Why would the car hire company attempt to contact Tanweer the day before he was due to return the car? Again, this is not revealed. The statement from the car hire company contradicts Hugo Keith's claim that they rang Tanweer's phone on 7 July, although the unreleased schedule showed this call:
[First 24-Hour Car Rentals] "Following 8 July, when the vehicle had not been returned as agreed, I rang the mobile number given by him on at least two occasions. However, the phone was off. I can only say, if I saw the man again, I would definitely recognise him."
[Hugo Keith] My Lady, we know that the last entry on the schedule prepared by Mr Stuart at your direction is that there was a call on 7 July, in fact, two minutes to 3 from First 24-hour Car Rentals to Tanweer's number.

Neither was the cell siting for Tanweer's mobile phone disclosed, which would have identified whether this phone was at Aldgate or, if lost, at least identified the location.

DS Stuart had also disclosed that the contact schedule only relates to calls made from 27 June 2005 onwards:
Q. Notwithstanding the fact that there were many thousands of calls made to and from any number of potentially relevant phone numbers, you prepared a schedule showing all the calls between the four men from 27 June onwards?
A. That's correct, sir, yes.
Q. In essence, the most relevant days leading up to the events of 7 July?
A. Yes, sir.

It isn't stated at which point the accused are supposed to have switched to their final set of 'conspiracy phones'; only that this occurred in the last few days before 7/7. Later in the proceedings, Ms. Caoilfhionn Gallagher, representing bereaved families, pushes for analysis of all the 'conspiracy' phones. DS Stuart may yet be called back to give further testimony on these, and we may yet receive clarification regarding how (or even if) Tanweer's phone was recovered.

Germaine Lindsay was said to have purchased and originally registered the phones, then transferred them to each of the others at a later time. DS Stuart makes it clear in his answers that although there was 'some slight mixing' in the use of the 'operational' phones, in that personal phones may have been used to ring an 'operational' phone number, by the time the accused were using their final set of phones, they were used solely for 'operational' purposes or calls to service providers.

Again, the implication is that this, along with clarification by DS Stuart that the use of the phones showed that the men were taking care over communications by buying prepaid unregistered phones and changing them regularly. Yet strangely, the behaviour of Hasib Hussain regarding his phone contradicts this assertion. Having earlier described how the top-up card for his 'operational phone' was found at his home address and the SIM card holder in a bag upon which Hussain's fingerprints were found, under questioning by Max Hill QC, DS Stuart details how the police knew about Hussain's personal phone:
Q. Secondly, in relation to Hasib Hussain, you analysed data relating to mobile number ********805, and two points again in relation to that. Firstly, that number was not used by Hussain on 7 July?
A. No, sir.
Q. But, secondly, through analysis of items recovered, including a SIM card, a mobile phone SIM card, found at Tavistock Square where Hussain's body was found, a download -- in other words, interrogation of the information held within that SIM card -- showed the 805 number saved within the SIM card under the title "My number"?
A. Yes, I believe that's the case.
Q. That goes towards attribution of that as a personal phone for Hussain, but one that you can say was not used on 7 July?
A. Correct, sir, yes.

If Hasib Hussain was only using this phone in the 'last few days' leading up to 7th July, then why take the trouble to program in his own personal number? Why would someone trying to 'avoid detection' do this anyway? Moreover, Hussain's personal phone was found by his brother, Imran, to contain not only Lindsay's number, but that of the keyholder for 18 Alexandra Grove, Dr Shakir Al Ani. Why program these numbers into his personal phone, if he was also in possession, at various times, of four (or more) 'conspiracy' phones. When asked by Lady Justice Hallet how the police were able to distinguish between the personal phones belonging to each men and the 'conspiracy' phones, in terms of usage, DS Stuart responds:
There was a distinct difference between the usage of the two types of phone. The personal phones all appeared to be unrelated, a lot of different people rung by them, but the enquiry showed that they were people that were known, historical friends and family. So that's why I can't remember there being anything which jumps out as being operational from a non-operational phone, my Lady.

If this is the case, why did Hussain have the 'operational' numbers found on his 'non-operational' phone by his brother, which in turn, according to the Daily Mirror, led him straight to the Alexandra Grove 'bomb factory' If Hussain was seriously trying to cover his tracks, he had made a pretty poor fist of it.

In summary, we've learned the following from DS Stuart's testimony regarding what Hugo Keith prefers to call the 'conspiracy' phones:
  • Khan's 'conspiracy' phone was too damaged to extract data from, yet counter-terrorism investigators appeared to have managed to do just that.
  • We do not know whether Tanweer had a 'conspiracy' phone with him on July 7th, because although DS Stuart mentioned calls being made from other phones to the phone attributed to Tanweer, he never mentions calls being made from that phone, nor does he mention that his phone was found at the Aldgate scene in the same way that the phones attributed to the three other men were found at the other blast sites.
  • We know that Tanweer lost his phone on 6 July but we do not know whether this was his personal phone or 'conspiracy' phone, or whether he found it before the next day. The cell siting of the car hire company call on either the 7 July according to the schedule or the 8 July according to the car hire company, would reveal the location of this phone but was not disclosed to the Inquest.
  • The four accused were trying to avoid detection to such an extent that they routinely left incriminating evidence, either in their own homes or the Alexandra Grove flat, provided a genuine address even when using a 'conspiracy' phone to arrange car hire and Hussain in particular, found a way of leading detectives straight to his personal number from his 'conspiracy' phone.
  • There may have been 15 or 19 'conspiracy' phones in total, but we have only been provided with testimony with the final 4 phones used. We were not allowed to see the contact schedule; this was "not for publication".
  • DS Stuart defines the "trade craft" use of the "conspiracy phones" thus: "Taking care over your communications, buying prepaid unregistered phones, changing them regularly to avoid detection ultimately" yet later states that Tanweer's phone, at least, was purchased, and registered, by Lindsay using a false name. Why would Lindsay go to the trouble of registering the phone at all, when an unregistered phone could so easily be purchased with a pre-paid SIM?


  1. Though digital data wasn't itself recovered from Khan's handset, being able to read the IMEI number of the handset from the sticker (usually located somewhere in the battery compartment) would permit the handset to be cross referenced with the records of mobile network providers (to which the police have access) and thereby identify its phone number and/or SIM IMSI number, which could also be read straight off the SIM card itself if still intact.

    Either way, once obtained, that unique, identifying number can then be looked up in the cell tower usage logs of the nation's mobile network providers to determine where the handset was, when, and what numbers were called and received, so long as the handset was switched on and connected to a GSM or 3G network at the time. I believe this explains the references to being "cell-sited" as quoted above.

    It wouldn't surprise me if network providers routinely store copies of all text messages sent and received, from which more intelligence could perhaps have been gleaned, though this is of course speculation on my part. Echelon & GCHQ have for decades been eavesdropping on all such electronic communications anyway, though they probably don't make it available to the police.

  2. It wouldn't surprise me either and it is, of course, perfectly reasonable that data could have been obtained by another method, but as written above, DI Kindness does not at any point state that this was done or how it was done. As ever, it's left open to speculation but shouldn't be.

  3. Apologies, I meant DS Stuart not DI Kindness.

  4. The closest it gets is this:

    Q. Are you also in a position, under the Regulation of Investigatory Powers Act, to make requests of telecommunication companies for their billing records and subscriber information?
    A. Yes, sir.
    Q. Are you able, therefore, to approach them and to get from them information showing both the use of the phone, the times of the use of the phone, text messages and where the phone is used?
    A. Yes, sir.
    Q. How are you able to determine where a phone is used?
    A. The networks gather a certain amount of information about each call, including the cell mast, the mobile phone mast through which the call was made, and they retain that data and they can provide that to us, sir.
    Transcripts, 14 October 2010, Morning Session, Page 3, Lines 1 on

    So they are "in a position to" and are "able to", but did they? If so, why not just say?

  5. I work for a police force and we regularly use 'real time'(live) cell site analysis to locate missing persons/vulnerable(suicidal) persons, etc.
    Mobile phone companies don't just retain informmation to produce your phone bills. Printouts detail text and attachment content and live recording of voice is possible as it is all digital.

  6. Very good work, as ever. A couple of things from the morning of the 11th October spring to mind.

    1) The Bloody Dishonourable Hugo Keith QC in his opening twaddle stated that Khan's phone was found in the tunnel between Kings Cross and Russell Square, not near Edgware Road:

    'Examination of Khan's mobile telephone
    which was recovered from the tunnel between Kings Cross and Russell Square showed that he sent a text message at 04.35 in the morning of 6 July saying: "Having major problem. Can't make time. Will ring you when I get it sorted. Wait at home."' (11th October, AM session, p59)

    Perhaps a slip of the tongue, but given the tendency in this investigation for them to find Khan's property wherever they find it useful to do so, perhaps not. Perhaps they found two phones (conspiracy or otherwise) belonging to Khan. Perhaps they're just talking a load of old bollocks.

    2) After Hugo 'the hatchet' Keith QC listed the various things apparently found in 18 Alexandra Grove he commented:

    'Other than tape over the net curtains to keep them affixed to the window frames so as to prevent people seeing in, the extraordinary chaos and profusion of equipment and materials scattered throughout 18 Alexandra Grove makes it plain, you may think, that the bombers took no steps to clear up behind them in an attempt to hide their evil work. They had no intention of returning, you may deduce, or of facing their accusers.' (11th October, AM session, p62-63)

    Unsurprisingly, Hugo of the old boy's network does not interpret this lax 'terrorist tradecraft' as evidence that the four (five? six?) knew they weren't going to be interdicted, but as evidence that they weren't going to return to the 'bomb factory' and therefore intended to kill themselves. You may deduce otherwise, of course.

    Keep up the good work.