The phone book that led us to Assad's spy chief in hiding

The most powerful investigative tool in the BBC’s hunt for Hussam Luka was not a satellite image, a data leak, or an AI-powered facial-recognition sweep. It was a paper notebook, found in an abandoned Damascus apartment, filled with 155 handwritten phone numbers. The BBC’s investigation, published this week, is a reminder that the intelligence trade still runs on the oldest currency in the world: human networks, and the willingness of people to talk.

Luka, known as “The Spider,” ran Syria’s General Security Directorate until Assad fell in December 2024. He is accused of orchestrating the 2015 Eid Massacre in Homs, which killed 28 people including 17 children, and of overseeing detention policies at Sednaya prison, the facility dubbed the “human slaughterhouse.” The UK, US, and EU sanctioned him. When the regime collapsed, he vanished with a large sum of money from the office safe, according to his former bodyguard.

What the BBC did next is the story. They photographed every page of the notebook, tested all 155 numbers from London, found 51 still operational, and called them in order of apparent importance. Everyone hung up. A reporter whose name had once been on a GSD wanted list flew to Syria and booked medical appointments with doctors listed in the book just to meet them. One doctor treated Luka, then ordered the journalist out and returned the consultation fee. Another had accompanied Luka’s mother to Russia but gave nothing else.

The breakthrough came from a building guard, then a bodyguard, then a driver, then a contact in Lebanon who had a number for Luka with a Russian country code. The BBC verified it by having the contact call Luka on speakerphone and ask questions only the spy chief would know. The voice answered correctly. When the BBC introduced themselves, Luka said: “I can’t take any risk talking on the phone in the position I’m in.” Asked if Russia was blocking him, he said: “I cannot talk. I can’t explain.”

The method is worth dwelling on, because it is almost the exact opposite of how the AI industry imagines investigative work. The prevailing narrative is that open-source intelligence has been supercharged by large language models: ingest millions of documents, let a model find the connections, generate a graph of who talks to whom. That works for volume. It does not work for trust.

What the BBC did was build trust one fragile human relationship at a time. The guard trusted them enough to give a bodyguard’s number. The bodyguard, angry at being abandoned, trusted them enough to give a driver’s number. The driver trusted them enough to answer, then stopped. The Lebanon contact trusted them enough to make a call on speakerphone. Each step required a judgment call about whether the person on the other end was lying, deflecting, or genuinely afraid. No model can make that call, because no model can sit in a hotel lobby at midnight and read a man’s face.

There is a second lesson, and it is about verification. The BBC did not accept the Russian number as proof. They constructed a test: questions only Luka would know, based on details gathered during the investigation. The voice answered instantly and correctly. That is a verification protocol, and it is the kind of thing AI systems are genuinely good at supporting: assembling the corpus of facts that make a test possible. The model can help you know what to ask. It cannot tell you whether the answer is true.

The story also exposes a gap in the AI industry’s own ambitions. Syria’s Attorney General, Hassan al-Turba, told the BBC the government has launched a lawsuit against Luka for “premeditated murder, torture, and death resulting from torture,” and is working to circulate an international warrant. The BBC located Luka in two suburban areas on the outskirts of Moscow. Russia, which backed Assad and gave him refuge, is not going to extradite anyone. The investigation produced a location, a voice, and a confession of sorts. It will not produce a trial.

For AI builders, the lesson is uncomfortable. The most valuable tool in this investigation was not a model. It was a reporter willing to book a fake medical appointment, a bodyguard with a grudge, and a phone book. The AI industry keeps promising that its tools will make the invisible visible. Here, the visible was already there: a notebook, a chandelier, a stack of gilded certificates. The hard part was getting people to talk, and knowing when to believe them.

None of that is automatable. What is automatable is the grunt work: testing 155 numbers, cross-referencing names, building the timeline of who fled when. The BBC did that by hand, in London and on the ground. A future investigation will do it with models, and it will be faster. But the final mile, the part where a man on a speakerphone answers questions about massacres and then hangs up, will still require a human to pick up the phone.

The last image in the story is Mohammed Towakatli, standing in the playground where his seven-year-old son Wael was killed in 2015, now planted with rows of saplings. He wants Luka returned to Syria and executed. “They look like humans but have no humanity in them at all,” he said. The BBC found the man he is talking about. The question of what happens next is not a technical one.