TKof Mahmoud

7/28/2019 TKof Mahmoud

1/9

All questions and comments can be referred to Glenn McGovern at [email protected]

The Targeted Killing of Mahmoud al-Mabhouh:By Glenn McGovern

January 19, 2010, Tuesday evening, Dubai, United Arab Emirates (UAE):Mahmoud al-Mabhouh, one of the founders of the Izzedine al-Qassam Brigades,the armed wing of Hamas, was killed in an apparent targeted attack. Travelingon false documents, he had arrived in UAE that day at approximately 1515 hrson a direct flight from Syria. From there he traveled by taxi to the Al Bustan

Rotana Hotel where he booked into room 230. Al-Mabhouh then departed thehotel for an unknown reason returning to his room at approximately 2024 hrs.

Around 1330 hours the following day the body of Al-Mabhouh was foundinsidehis room by hotel staff. It was first believed/reported that he had died of a heartattack, but subsequent forensic investigation by a French firm revealed he haddied of poisoning. Authorities also released that he had signs of beingsmothered and burned, apparently after being electrocuted.

Al-Mabhouh was reported to have been in Dubai to arrange a shipment ofweapons to Gaza. It was also reported that he normally traveled with aprotective detail, but that there had been some sort of problem with the flight,and the detail was and/or did follow on a second flight. After the killing, theassassins put the Do not disturb sign on the door as they left. The UAEauthorities stated they were searching for twenty-six subjects using Europeanpassports that had apparently fled the country prior to the discovery of the body.

INVESTIGATION:


2/9


As of this writing, the Dubai authorities have identified twenty-six individuals assuspects or persons of interest, making use of bogus passports from France,Australia, Ireland, the United Kingdom, and Germany. Investigators using cellphone call analysis, including cell tower analysis, as well as CCTV and credit

card use, have been able to recreate the events leading up to, during andfollowing the targeted killing.

While the preparation work on the ground in Dubai is believed by localauthorities to have began several months to perhaps a year before (throughreview of passport activity), this operation went active on Monday, January 18,2010 (although given the estimated origins of the hit team, most probably begana day or two before) when an advance team of fourteen arrived in country. Atapproximately 0645 hrs, three individuals arrived from Zurich at Dubai airportby two separate airlines. At approximately 2230 hours that same day, a fourth

arrived from Zurich. At 2300 hours that same day, six individuals arrived atDubai airport from Rome on the same flight. Finally, at 2325 hours, four morearrived in Dubai from Zurich.

Early on January 19, 2010, six subjects flew into Dubai from Frankfurt, Germany.There were followed shortly after by two more that arrived from Paris, France.Al-Mabhouhs flight arrived in Dubai from Syria at approximately 1515 hrs. Atthe time, he was traveling alone under a false passport. At the airport, al-Mahhouh was seen via CCTV walking to the area of taxis outside of the terminal.In the background, one of the suspected team members was seen speaking on a

mobile phone. Authorities believe this individual was one of the spottersadvising the command center of their targets arrival.


3/9


From there he went to the Al Bustan Rotana Hotel (seen above and below), adistance of only three kilometers from the airport. Upon checking in, he wasescorted to his room, number 230. As he and the hotel clerk entered the elevator,two men dressed as though they were returning from a game of tennis, joinedthem. As the elevator arrived on the second floor, al-Mabhouh exited with theclerk, as did the two men. Al-Mabhouh immediately made a left turn down the

hallway towards the room. The other two men paused, briefly speaking to eachother, then the taller of the two walked down the direction al-Mabhouh hadtaken. As al-Mabhouh stopped at his room, the tall man in tennis clothingcontinued down the hall.


4/9


Shortly after this episode, room 237, which was directly across from al-Mabhouhs room was booked from a phone call by a man identifying himself asElsinger and originated from another nearby hotel. By that evening, anestimated seven individuals had taken up position inside of room 237.

At approximately 1600 hours the same day, five individuals who had arrived toDubai from Zurich the previous day began departing. The first left back toZurich leaving at 1620 hrs, followed by three more to Hong Kong at 2040 hrs.

The last left en route to Doha, Qatar at approximately 2235 hrs (after the killingwas believed to have occurred). One of those individuals was Elsinger.

While there was no CCTV camera viewing al-Mabhouhs hotel door, cameras didcatch the individual using the identity of Daveron near the second floor elevator.At approximately 2000 hrs, he was seen speaking to a person (believed to be aninnocent hotel guest) who had exited the elevator delaying that person forseveral seconds. At approximately the same time, someone attempted to re-program the security door lock system of room 230. It is unclear if the attemptwas successful, but given how the attack is suspected to have occurred, it doesnot seem likely.

At approximately 2024 hours, Al-Mabhouh returned to his room after havingdeparted earlier for some unknown reason. Shortly after his return, there was aknock at the door. It is believed that one of the female members was behind thatknock and upon opening the door; al-Mabhouh was hit by an electric stunweapon of some type, which resulted in his body being instantly paralyzed asthe electricity rocketed through his body. At that point, an unknown number of


5/9


individuals presumably waiting inside of room 237 flowed into al-Mabhouhsroom. He was quickly taken into custody and given an injection ofsuccinylcholine chloride (detected during subsequent toxicology tests).

Succinylcholine chloride is a very powerful muscle relaxant that causes a

paralysis of the muscles in the face and those used to breathe and move. It ischaracterized by its rapid onset, usually between 30 seconds to 1 minute, butlasts only between two and three minutes if not continued. With this drug comesa warning to physicians stating it should only be administered when there arefacilities for instant tracheal intubation for providing adequate ventilation. Thedrug is rapidly metabolized, by the body and dispensed via urine within arelatively short time period.

At approximately2046 hrs, all members

of the team, includingthose believed to havebeen in room 237 (fourof whom are seen onthe right), are allrecorded by CCTVexiting the hotel overa very brief period oftime.

Early on January 20, 2010, the mass exodus of the remaining seventeen knownindividuals began to depart. All would be on their flights out of the country by0930 hrs. Three returned to Zurich, six flew to Hong Kong, two to Frankfurt, twoto Rome, two to Paris and the final two to Johannesburg. At approximately 1330hrs, the deceased body of al Mabhouh was discovered in his room. The door wasreportedly locked from the inside and a Do Not Disturb sign hanging on thedoorknob. There was no information on where he was found inside of the room,and how the decision to make entry was made.

Dubai authorities apparently realizing who the dead man was began acomprehensive investigation. Making use of the CCTV, cell phone analysis andcredit card analysis, they quickly began to hone in on the hit team. One of themost interesting facts was the discovery that three cell phones believed to beused by the assassins, made repeated calls and text messages to four differentnumbers in Vienna. No calls were found to have been made between teammembers. With this information, they were then able to start identifying thosethey believed were involved. Interestingly, they found that the passports used


6/9


by the suspects, belong to legitimate citizens from a number of differentcountries matching the fake passports.

At some point in the investigation, the authorities began to determine that theindividual known as Elsinger and the woman using the Irish identity of Gail

Folliard appeared to be in more of a control position of the operation. It wasfound that they had met at a nearby shopping center where CCTV capturedthem having a conversation. Members of the group were tracked as theyswitched hotels, changed into disguises including the use of false beards and hairwigs. The CCTV showed teams of two moving through the lobby of the hotel,allowing for them to maintain an eye on the area, but without spending andextended amount of time therefore reducing the potential for suspicions to beraised.

The Folliard woman (seen on the left)

and a man using the Irish passport of KevinDaveron were seen on the second floornear al-Mabhouhs room, possibly asspotters. They were found to haveswitched hotels the afternoon of the killingand were dressed in such a way as to poseas hotel staff. Later, CCTV noted the baldDaverson wearing a dark wig and glasseswhile Folliard removed a blond wig toreveal she was a brunette. Authorities also

reported the teams used some sort ofsophisticated short-range communication system to keep track of their target.

Dubai authorities later disclose that most if not all of the suspects used Metabankissued MasterCards to pay for the travel (presumably airfare, hotel, vehiclerentals and food). These cards are issued on a prepaid basis under theirEmployee Payment Program which allows companies to deposit funds directlyto the card account. This company is partnered with Payoneer, Inc. a New Yorkbased company with an R&D office in Tel Aviv. Further, this company is headedby Yuval Tal, a former member of Israeli Special Forces.

The Payoneers Office in New York City consists of a single door with a whitesign affixed to the outside indicating Payoneer. This office is located at 1841Broadway, Room 520, New York, NY. They also maintain an office at 410 ParkAve., New York. Regardless, the cards biggest users are found in Russia,Kyrgyzstan, Uzbekistan, and Kazakhstan.


7/9


As of this writing, INTERPOL has issued Red Notices for some twenty-sevenindividuals believed to be involved in the attack, all of which are stolen identitiesof real people from the countries the passports belong, so all the is left is thepictures of the hit team.

ANALYSIS:

This attack offers a unique insight into organized targeted attacks, both from theperspectives of protective operations as well as investigations. Putting the moraland legal issues aside, for the mans protective detail (if there was one), it was afailure and for law enforcement, a high profile murder that requiresinvestigation. This would hold true in just about every city in world, be it Dubaior San Jose, California.

The attack itself, regardless of who carried it out, would appear to have stemmed

from a nation/state given the amount of manpower and resources employed. Itis important to study these attacks as in many of the previous cases in which agovernment agency was suspected of being the sponsor, those responsible werenever caught. What becomes of these individuals is generally never known, butshould they ever decide to train potential adversaries, or carry out operations inour jurisdiction, we need to be familiar with the tactics and methods ofoperation.

Obviously, the hit squad had considerable intelligence that their target was goingto be in Dubai during a certain period. Whether this was obtained from

wiretaps, signals intelligence, or informant(s) matters little. What is key is theyknew where he was going to be in advance. Further, it has been reported thatcertain passport names were discovered to have been in Dubai months prior tothe attack. It is here that the genius of stealing a persons identity by a hit team isrevealed. In some of the cases, the individuals whose identity was stolen havepublically stated they had never been to Dubai. If this was the case for most ofthe twenty-six alleged members, then it illustrates that al-Mabhouh was knownto have visited Dubai with enough frequency to provide the hit team with theopportunity to preplan their strike (meaning members of the hit team werevisiting the area in order to become more familiar with their coming operationalarea). Once the final details were obtained, some members of the team wouldonly need to update and fine-tune the operation plan. If however, some of thesereal individuals had visited Dubai in the past, then it would serve to furthercomplicate the subsequent investigation for authorities trying to determine ifearlier visits were benign or part of the preplanning for the attack.

The location of the killing is of interest as it offers pros and cons for the hit team.First, it has been reported that members of the hit team were at two hotels prior


8/9


to al-Mabhouhs arrival, at which point the remaining team members switchedlocations. This could indicate that Mabhouh changed up his hotels when stayingin Dubai. It could also mean that while part of the team checked in to the hotelprior to al-Mabhouhs arrival, the rest of the team held up at the other hotelwaiting for their target. Then the team checked in to spread out their numbers

and decrease suspicions.

A targeted hit conducted inside a hotel while rare is certainly not new. Thenature of a hotel provides the hit team with a certain amount of cover in which toblend into. With the moderate amount of pedestrian traffic in and around ahotel, it would be difficult for an individual and/or protective team to spot apotential threat. This is all the more so if it is true that the hit team consisted ofsome twenty-seven men and women. The use of disguise merely furtherdecreased the likelihood of detection. The use of spotters on the second floorprovides further indication of the difficulty in carrying out such an operation in

such a location, as the potential for third party awareness and discovery isconsiderable.

A close personal friend of Khaled Meshaal, al-Mabhouh was responsible for thekidnapping and ultimate killing of two Israeli soldiers as well as many otherkillings and suicide bomber attacks. Mahmoud al-Mabhouh was a survivor oftwo separate assassination attempts and was no doubt well aware he was atargeted man. Given that, he was used to being aware of what was going onaround him. In this case, he is known to have missed the spotter(s) at the airportand hotel, and missed the surveillance that undoubtedly was present when he

briefly left the hotel the night he was killed. Also, the knock on the door by thewoman, if that is indeed what happened, took advantage of a natural reductionof threat (in the authors opinion) detection. Looking through the hotel peepholeto see an attractive woman dressed similarly to hotel staff could have been allthat was needed to gain the momentary surprise. Could a protective detail havemade the difference? It is hard to know, but it certainly would have complicatedthings for the hit team.

The United Arab Emirates is a small country that is approximately 1,588 squaremiles in area (smaller then the San Francisco Bay Area) and a population of justover 2.2 million (as of 2008). The main city and seat of the government is Dubaiwith Dubai International airport the only major point of entry by plane in (andone of the top twenty busiest airports in the world). All of this provided theauthorities with an easier investigation, although still a major time and resourceintensive one. This was augmented immensely by the Dubai governmentsextensive use of CCTV surveillance of the city (similar to that found in London,England).


9/9


Consider conducting such an investigation in the Bay Area. Approximately8,700 square miles in area and a population of over 7 million (as of 2008), withthree international airports within one hours drive of each other and one morewithin a two hour drive. The number of hotels and motels located in this areaare almost inconceivable to determine. This is in addition to the railways, buses

and roadways into and out of the area, all without an extensive CCTVmonitoring system. If you were the investigator initially called to the scene ofthis attack, what would you do?

TKof Mahmoud

Documents

Transcript of TKof Mahmoud