Did mobile phone records help lead US intelligence to General Qassem Soleimani, commander of the Iranian Revolutionary Guard Corps Quds force, who was killed by a drone attack in January?
In early August, the AhluiBayt News Agency based in Qom, in the north of the Islamic Republic of Iran, reported that Gen. Soleimani, was assassinated as a result of information provided to US intelligence by an Iraqi telecommunications company.
Gen. Soleimani was killed on 3rd January 2020 as his two-vehicle convoy left Baghdad International Airport. Open sources state that he was most probably killed by a Lockheed Martin AGM-114 series Hellfire air-to-surface missiles launched by a US Air Force General Atomics MQ-9 Reaper Unmanned Aerial Vehicle. Also killed was Jamal Abu Mahdi al-Muhandis believed to be a high-ranking member of the Quds force which is responsible for unconventional military operations on behalf of the Iranian government.
The AhluiBayt report said that an Iranian committee investigating the assassination had been handed documents by unnamed commanders of the Iraqi al-Hashd ash-Sha’bi Iraqi counter-insurgency organisation. These documents claimed that an Iraqi telecommunications company had supplied information concerning Mr. al-Muhandis’ cell phone to US Army units based at Camp Victory on the outskirts of Baghdad International Airport. This claim seems odd as the US Army vacated Camp Victory in 2011. Nonetheless it is possible that cell phone transmissions may have played their role in helping locate Gen. Soleimani.
IMSI and TMSI
Using Mr. al-Muhandis’ cell phone to find Gen. Soleimani would be like following a trail of breadcrumbs. The first thing required by Communications Intelligence (COMINT) practitioners would be Mr. al-Muhandis’ cell phone number. If this was provided by the telecommunications company it would be the first, and arguably most important step, in finding Gen. Soleimani.
To understand how a cell phone reveals someone’s location, one must understand how cell phone transmissions work. The cell phone number forms part of the phone’s International Mobile Subscriber Identity (IMSI). The IMSI is a unique numerical code. It includes a series of digits representing the country where the phone is registered, the network it uses within that country and the phone’s Mobile Subscriber Identification Number (MSIN). The MSIN is the number assigned to that phone which the handset uses to identify itself to a cell phone network.
Every time a cell phone joins a network it transmits the IMSI as a digital ‘handshake’. The network responds by providing that phone with a randomly assigned Temporary Mobile Subscriber Identity (TMSI) code. The TMSI can be changed for that phone at any given moment with the intention of frustrating attempts by eavesdroppers to identify and track the phone using the IMSI. That said the IMSI must still be used, albeit briefly, to perform the digital handshake and to re-join the network if the connection between the phone and the network is lost. Every time the phone moves out of the local coverage of one part of the network and moves into another, the IMSI is sent anew, and the process repeated.
Once US COMINT practitioners had Mr. al-Muhandis IMSI number, it would be possible to track his movements. One source with close links to the Iraqi and US security and intelligence communities told Armada that both Mr. al-Muhandis and Gen. Soleimani would probably have used several different cell phones in a bid to frustrate attempts to gather COMINT. Nonetheless, it you are continually collecting Imagery Intelligence (IMINT) and Human Intelligence (HUMINT) on their whereabouts, you can see each time they make a call, and hence collect the IMSI as the phone connects with the local network. These IMSI numbers can potentially be detected by US communications eavesdropping satellites such as the US National Reconnaissance Office’s Advanced Orion constellation, or by UAVs or inhabited aircraft flying nearby equipped with COMINT systems. These assets are almost certainly be able to detect and locate Very/Ultra High Frequency (V/UHF – 30 megahertz to three gigahertz) military and civilian telecommunications.
Importantly, tracking Mr. al-Muhandis’ phone would lead intelligence operatives to other interesting targets and their cell phones. IMSI numbers from associates can then be gleaned and tracked. It is possible that Mr. al-Muhandis’ IMSI number led US intelligence operatives to Gen. Soleimani. With both Mr. al-Muhandis and Gen. Soleimani firmly in the sites of the US intelligence community, it would just become a matter of time before the military could move in for the kill.
It is possible that COMINT, HUMINT and IMINT informed the US intelligence community that Gen. Soleimani who had visited Syria before 3rd January was on his way to Iraq. The attack occurred against the backdrop of a worsening security situation in the latter. Anti-Iranian sentiment had increased within elements of the local Iraqi population. In a bid to reassert Iranian influence Gen. Soleimani had taken the decision to use the local pro-Iranian Kata’ib Hezbollah Shia insurgence group to increase attacks on US targets in Iraq. The group was later blamed for a rocket attack on 27th December 2019 on the K-1 airfield in Kirkuk Province, northern Iraq, where US forces supporting Operation Inherent Resolve against the ISIS (Islamic State of Iraq and Syria) were based. The attack killed one US defence contractor and injuring several US and Iraqi military personnel.
Motive, Means, Opportunity
The decision to kill Gen. Soleimani was believed to have been taken by US President Donald Trump in late December. Then it was just a matter of waiting for the right moment. The USAF is thought to base MQ-9s are Ali al-Salem airbase in Kuwait, Qatar’s Al-Udeid airbase and Al Dafra airbase in the United Arab Emirates. At least one or more MQ-9 UAV maybe permanently stationed above Iraq on a rolling basis ready to provide rapid air-to-ground attack when needed. Once US intelligence had determined Gen. Soleimani was at Damascus International Airport and headed for Baghdad, they knew that they had at the most one and a half hours’ flight time until Gen. Soleimani arrived to get the MQ-9 within striking distance. As it happened, his plane was delayed by two hours, giving even more time to get the MQ-9 in position. Targeting experts may have also determined that sections of road around the airport provided good locations for the attack while minimising the risk of civilian casualties: At 12.32am on the morning of 3rd January, there was unlikely to be much traffic. By 12.48 Gen. Soleimani was dead. His two-car convoy was incinerated by the AGM-114s.
There is no doubt that Gen. Soleimani and Mr. al-Muhandis were scrupulous about security: “They often don’t have their phones on them, and one of their aide-de-camps usually has a bag of phones that they carry around which they continually change when making calls.” That said, both men still needed to communicate with the outside world, and each phone still has to transmit its IMSI.
Did Mr. al-Muhandis’ phone provided the break which lead US intelligence experts to Gen. Soleimani? This is impossible to say with certainty: “I find it hard to believe that we were not already aware of al-Muhandis and Soleimani’s cell phone particulars,” the source said. The deteriorating security situation in Iraq meant that US forces “had an intense ISR (Intelligence, Surveillance and Reconnaissance) soak over Baghdad.” Iran’s involvement in this security situation provided the motive, the MQ-9 provided the means and the General’s convoy moving along a quiet road in the dead of night the opportunity: “We knew where he lived, we knew the signature of his convoys and we knew whenever he was in Iraq. The only difference was that this time, we popped him.” That COMINT from cell phones will have played its role in keeping tabs on Gen. Soleimani is all but certain, that this COMINT was handed by an Iraqi telecoms company to the US Army remains a subject for debate.
