The Targeted Killing of Mahmoud al-Mabhouh:

By Glenn McGovern

January 19, 2010, Tuesday evening, Dubai, United Arab Emirates (UAE): Mahmoud al-Mabhouh, one of the founders of the Izzedine al-Qassam Brigades, the armed wing of Hamas, was killed in an apparent targeted attack. Traveling on false documents, he had arrived in UAE that day at approximately 1515 hrs on a direct flight from Syria. From there he traveled by taxi to the Al Bustan Rotana Hotel where he booked into room 230. Al-Mabhouh then departed the hotel for an unknown reason returning to his room at approximately 2024 hrs. Around 1330 hours the following day the body of Al-Mabhouh was found inside his room by hotel staff. It was first believed/reported that he had died of a heart attack, but subsequent forensic investigation by a French firm revealed he had died of poisoning. Authorities also released that he had signs of being smothered and burned, apparently after being electrocuted. Al-Mabhouh was reported to have been in Dubai to arrange a shipment of weapons to Gaza. It was also reported that he normally traveled with a protective detail, but that there had been some sort of problem with the flight, and the detail was and/or did follow on a second flight. After the killing, the assassins put the Do not disturb sign on the door as they left. The UAE authorities stated they were searching for twenty-six subjects using European passports that had apparently fled the country prior to the discovery of the body. INVESTIGATION:
All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

As of this writing, the Dubai authorities have identified twenty-six individuals as suspects or persons of interest, making use of bogus passports from France, Australia, Ireland, the United Kingdom, and Germany. Investigators using cell phone call analysis, including cell tower analysis, as well as CCTV and credit card use, have been able to recreate the events leading up to, during and following the targeted killing. While the preparation work on the ground in Dubai is believed by local authorities to have began several months to perhaps a year before (through review of passport activity), this operation went active on Monday, January 18, 2010 (although given the estimated origins of the hit team, most probably began a day or two before) when an advance team of fourteen arrived in country. At approximately 0645 hrs, three individuals arrived from Zurich at Dubai airport by two separate airlines. At approximately 2230 hours that same day, a fourth arrived from Zurich. At 2300 hours that same day, six individuals arrived at Dubai airport from Rome on the same flight. Finally, at 2325 hours, four more arrived in Dubai from Zurich. Early on January 19, 2010, six subjects flew into Dubai from Frankfurt, Germany. There were followed shortly after by two more that arrived from Paris, France. Al-Mabhouhs flight arrived in Dubai from Syria at approximately 1515 hrs. At the time, he was traveling alone under a false passport. At the airport, alMahhouh was seen via CCTV walking to the area of taxis outside of the terminal. In the background, one of the suspected team members was seen speaking on a mobile phone. Authorities believe this individual was one of the spotters advising the command center of their targets arrival.

All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

From there he went to the Al Bustan Rotana Hotel (seen above and below), a distance of only three kilometers from the airport. Upon checking in, he was escorted to his room, number 230. As he and the hotel clerk entered the elevator, two men dressed as though they were returning from a game of tennis, joined them. As the elevator arrived on the second floor, al-Mabhouh exited with the clerk, as did the two men. Al-Mabhouh immediately made a left turn down the hallway towards the room. The other two men paused, briefly speaking to each other, then the taller of the two walked down the direction al-Mabhouh had taken. As al-Mabhouh stopped at his room, the tall man in tennis clothing continued down the hall.

All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

Shortly after this episode, room 237, which was directly across from alMabhouhs room was booked from a phone call by a man identifying himself as Elsinger and originated from another nearby hotel. By that evening, an estimated seven individuals had taken up position inside of room 237. At approximately 1600 hours the same day, five individuals who had arrived to Dubai from Zurich the previous day began departing. The first left back to Zurich leaving at 1620 hrs, followed by three more to Hong Kong at 2040 hrs. The last left en route to Doha, Qatar at approximately 2235 hrs (after the killing was believed to have occurred). One of those individuals was Elsinger. While there was no CCTV camera viewing al-Mabhouhs hotel door, cameras did catch the individual using the identity of Daveron near the second floor elevator. At approximately 2000 hrs, he was seen speaking to a person (believed to be an innocent hotel guest) who had exited the elevator delaying that person for several seconds. At approximately the same time, someone attempted to reprogram the security door lock system of room 230. It is unclear if the attempt was successful, but given how the attack is suspected to have occurred, it does not seem likely. At approximately 2024 hours, Al-Mabhouh returned to his room after having departed earlier for some unknown reason. Shortly after his return, there was a knock at the door. It is believed that one of the female members was behind that knock and upon opening the door; al-Mabhouh was hit by an electric stun weapon of some type, which resulted in his body being instantly paralyzed as the electricity rocketed through his body. At that point, an unknown number of
All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

individuals presumably waiting inside of room 237 flowed into al-Mabhouhs room. He was quickly taken into custody and given an injection of succinylcholine chloride (detected during subsequent toxicology tests). Succinylcholine chloride is a very powerful muscle relaxant that causes a paralysis of the muscles in the face and those used to breathe and move. It is characterized by its rapid onset, usually between 30 seconds to 1 minute, but lasts only between two and three minutes if not continued. With this drug comes a warning to physicians stating it should only be administered when there are facilities for instant tracheal intubation for providing adequate ventilation. The drug is rapidly metabolized, by the body and dispensed via urine within a relatively short time period. At approximately 2046 hrs, all members of the team, including those believed to have been in room 237 (four of whom are seen on the right), are all recorded by CCTV exiting the hotel over a very brief period of time. Early on January 20, 2010, the mass exodus of the remaining seventeen known individuals began to depart. All would be on their flights out of the country by 0930 hrs. Three returned to Zurich, six flew to Hong Kong, two to Frankfurt, two to Rome, two to Paris and the final two to Johannesburg. At approximately 1330 hrs, the deceased body of al Mabhouh was discovered in his room. The door was reportedly locked from the inside and a Do Not Disturb sign hanging on the doorknob. There was no information on where he was found inside of the room, and how the decision to make entry was made. Dubai authorities apparently realizing who the dead man was began a comprehensive investigation. Making use of the CCTV, cell phone analysis and credit card analysis, they quickly began to hone in on the hit team. One of the most interesting facts was the discovery that three cell phones believed to be used by the assassins, made repeated calls and text messages to four different numbers in Vienna. No calls were found to have been made between team members. With this information, they were then able to start identifying those they believed were involved. Interestingly, they found that the passports used
All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

by the suspects, belong to legitimate citizens from a number of different countries matching the fake passports. At some point in the investigation, the authorities began to determine that the individual known as Elsinger and the woman using the Irish identity of Gail Folliard appeared to be in more of a control position of the operation. It was found that they had met at a nearby shopping center where CCTV captured them having a conversation. Members of the group were tracked as they switched hotels, changed into disguises including the use of false beards and hair wigs. The CCTV showed teams of two moving through the lobby of the hotel, allowing for them to maintain an eye on the area, but without spending and extended amount of time therefore reducing the potential for suspicions to be raised. The Folliard woman (seen on the left) and a man using the Irish passport of Kevin Daveron were seen on the second floor near al-Mabhouhs room, possibly as spotters. They were found to have switched hotels the afternoon of the killing and were dressed in such a way as to pose as hotel staff. Later, CCTV noted the bald Daverson wearing a dark wig and glasses while Folliard removed a blond wig to reveal she was a brunette. Authorities also reported the teams used some sort of sophisticated short-range communication system to keep track of their target. Dubai authorities later disclose that most if not all of the suspects used Metabank issued MasterCards to pay for the travel (presumably airfare, hotel, vehicle rentals and food). These cards are issued on a prepaid basis under their Employee Payment Program which allows companies to deposit funds directly to the card account. This company is partnered with Payoneer, Inc. a New York based company with an R&D office in Tel Aviv. Further, this company is headed by Yuval Tal, a former member of Israeli Special Forces. The Payoneers Office in New York City consists of a single door with a white sign affixed to the outside indicating Payoneer. This office is located at 1841 Broadway, Room 520, New York, NY. They also maintain an office at 410 Park Ave., New York. Regardless, the cards biggest users are found in Russia, Kyrgyzstan, Uzbekistan, and Kazakhstan.

All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

As of this writing, INTERPOL has issued Red Notices for some twenty-seven individuals believed to be involved in the attack, all of which are stolen identities of real people from the countries the passports belong, so all the is left is the pictures of the hit team. ANALYSIS: This attack offers a unique insight into organized targeted attacks, both from the perspectives of protective operations as well as investigations. Putting the moral and legal issues aside, for the mans protective detail (if there was one), it was a failure and for law enforcement, a high profile murder that requires investigation. This would hold true in just about every city in world, be it Dubai or San Jose, California. The attack itself, regardless of who carried it out, would appear to have stemmed from a nation/state given the amount of manpower and resources employed. It is important to study these attacks as in many of the previous cases in which a government agency was suspected of being the sponsor, those responsible were never caught. What becomes of these individuals is generally never known, but should they ever decide to train potential adversaries, or carry out operations in our jurisdiction, we need to be familiar with the tactics and methods of operation. Obviously, the hit squad had considerable intelligence that their target was going to be in Dubai during a certain period. Whether this was obtained from wiretaps, signals intelligence, or informant(s) matters little. What is key is they knew where he was going to be in advance. Further, it has been reported that certain passport names were discovered to have been in Dubai months prior to the attack. It is here that the genius of stealing a persons identity by a hit team is revealed. In some of the cases, the individuals whose identity was stolen have publically stated they had never been to Dubai. If this was the case for most of the twenty-six alleged members, then it illustrates that al-Mabhouh was known to have visited Dubai with enough frequency to provide the hit team with the opportunity to preplan their strike (meaning members of the hit team were visiting the area in order to become more familiar with their coming operational area). Once the final details were obtained, some members of the team would only need to update and fine-tune the operation plan. If however, some of these real individuals had visited Dubai in the past, then it would serve to further complicate the subsequent investigation for authorities trying to determine if earlier visits were benign or part of the preplanning for the attack. The location of the killing is of interest as it offers pros and cons for the hit team. First, it has been reported that members of the hit team were at two hotels prior
All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

to al-Mabhouhs arrival, at which point the remaining team members switched locations. This could indicate that Mabhouh changed up his hotels when staying in Dubai. It could also mean that while part of the team checked in to the hotel prior to al-Mabhouhs arrival, the rest of the team held up at the other hotel waiting for their target. Then the team checked in to spread out their numbers and decrease suspicions. A targeted hit conducted inside a hotel while rare is certainly not new. The nature of a hotel provides the hit team with a certain amount of cover in which to blend into. With the moderate amount of pedestrian traffic in and around a hotel, it would be difficult for an individual and/or protective team to spot a potential threat. This is all the more so if it is true that the hit team consisted of some twenty-seven men and women. The use of disguise merely further decreased the likelihood of detection. The use of spotters on the second floor provides further indication of the difficulty in carrying out such an operation in such a location, as the potential for third party awareness and discovery is considerable. A close personal friend of Khaled Meshaal, al-Mabhouh was responsible for the kidnapping and ultimate killing of two Israeli soldiers as well as many other killings and suicide bomber attacks. Mahmoud al-Mabhouh was a survivor of two separate assassination attempts and was no doubt well aware he was a targeted man. Given that, he was used to being aware of what was going on around him. In this case, he is known to have missed the spotter(s) at the airport and hotel, and missed the surveillance that undoubtedly was present when he briefly left the hotel the night he was killed. Also, the knock on the door by the woman, if that is indeed what happened, took advantage of a natural reduction of threat (in the authors opinion) detection. Looking through the hotel peephole to see an attractive woman dressed similarly to hotel staff could have been all that was needed to gain the momentary surprise. Could a protective detail have made the difference? It is hard to know, but it certainly would have complicated things for the hit team. The United Arab Emirates is a small country that is approximately 1,588 square miles in area (smaller then the San Francisco Bay Area) and a population of just over 2.2 million (as of 2008). The main city and seat of the government is Dubai with Dubai International airport the only major point of entry by plane in (and one of the top twenty busiest airports in the world). All of this provided the authorities with an easier investigation, although still a major time and resource intensive one. This was augmented immensely by the Dubai governments extensive use of CCTV surveillance of the city (similar to that found in London, England).
All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com

Consider conducting such an investigation in the Bay Area. Approximately 8,700 square miles in area and a population of over 7 million (as of 2008), with three international airports within one hours drive of each other and one more within a two hour drive. The number of hotels and motels located in this area are almost inconceivable to determine. This is in addition to the railways, buses and roadways into and out of the area, all without an extensive CCTV monitoring system. If you were the investigator initially called to the scene of this attack, what would you do?

All questions and comments can be referred to Glenn McGovern at Protectiveintel@yahoo.com