Before the Blast, a Bill

CN-01

Published by Cartel DocsAbout 12 minutes to read

Investigations · The overseas apparatus

Contents

The paid visit
The work before the weapon
A business can provide more than cash
The patron’s money
Where criminal proceeds enter
Money available, money delivered
Back to the name on the card
Sources

The charred laminate of a fake Michigan driver’s license, bearing the fabricated name Jacque Felipe Martin, was among the first forensic clues salvaged from the smoking asphalt outside Bulgaria’s Burgas airport on July 18, 2012^[1],^[2]. The detonation of an explosive backpack tore through a charter bus carrying Israeli vacationers, killing five tourists, their local driver, and the bomber himself^[1],^[2]. Yet long before the bomb exploded, someone had to pay the bills: rental vehicles chartered under aliases like Ralph William Rico, mid-tier seaside hotel rooms booked in cash, forged identity kits, and international flight itineraries spanning continents^[1]. In September 2020, Bulgarian courts handed down life sentences in absentia to Meliad Farah and Hassan El Hajj Hassan for their operational roles in Hezbollah’s radical wing^[3]. But the court’s judgment could not answer the deeper financial riddle: behind every spectacular blast lies an unglamorous ledger of administrative costs, paid long in advance through a patchwork of state patronage, commercial fronts, and illicit global enterprise^[1],^[3].

That is where an attack’s financial story becomes harder to tell. The final act is visible. The expenses that preceded it are scattered among ordinary transactions, specialized services and years of preparation. Following the money backward means reconstructing those layers before asking who supplied the funds.

The paid visit

Cyprus offers an unusually concrete glimpse of one layer^[7]. Hussein Bassam Abdallah’s task was to inspect stored chemicals^[7]. According to the account heard by the Larnaca court in 2015, he had visited the island roughly ten times, staying around ten days on each trip and receiving €3,500 per visit^[7]. When police arrested him that May, he had been looking for a new storage location^[7].

The payment bought more than a few days’ attendance^[7]. In the court report, Abdallah said his dual nationality and English ability helped explain his selection^[7]. He admitted Hezbollah membership and pleaded guilty; the longest of his concurrent sentences was six years^[7]. The court also credited his cooperation and limited role, while his defense emphasized that he was neither a leader nor an executive^[7].

His was not the only Cyprus prosecution involving activity before an attack^[8]. In the separate Yaacoub case, a four-year sentence followed convictions on five of eight counts^[8]. The Supreme Court majority upheld the conviction in 2014, with a dissent questioning aspects of the criminal-organization classification and the inferences drawn from preparatory acts^[8]. The disagreement concerned how to understand the evidence before violence occurred^[8].

Read together, the cases make preparation tangible. A person must be available. A location must remain accessible. Travel can recur long before an operation reaches a decision point. Paying to preserve that capacity is different from buying the materials for a single attack, and potentially much longer-lasting. The expense is readiness.

The same distinction appears in American cases^[6]. Prosecutors described Hezbollah’s Islamic Jihad Organization—also called the External Security Organization or “910”—as responsible for overseas intelligence and terrorist activity^[6]. Their 2017 charging account alleged that Samer El Debek received a salary after recruitment in 2007 or 2008 and continued receiving payments through about 2015^[6]. It also described training and missions in Thailand and Panama^[6]. These were allegations against El Debek, rather than a final judgment^[6].

A salary running across years is a different financial commitment from reimbursement for one trip. It supports a person who may be trained, tasked, recalled and sent elsewhere. An organization maintaining such personnel needs a continuing flow of usable resources, even when a particular operation never happens. The distinction resembles the difference between keeping a workshop open and paying for one repair. The building, skills and tools must exist before the individual job arrives. For an investigator, the practical question changes accordingly: was a payment maintaining that standing capacity, or was it assigned to a specific operation? The answer determines what a financial record can establish.

The work before the weapon

Ali Kourani’s case shows what that continuity could involve^[4],^[5]. The Justice Department’s account of his 2019 conviction and forty-year sentence described surveillance, searches for weapons suppliers and the transmission of intelligence to Lebanon on digital storage media^[4]. The work was directed toward possible future attacks^[4].

The appellate court’s account placed intelligence-gathering missions in the United States and Canada between 2008 and 2015^[5]. It also traced his acquisition of American citizenship and a passport in 2009^[5]. In 2021, the Second Circuit affirmed his convictions and sentence after considering challenges concerning his statements to investigators, counsel, jury instructions, the evidence and punishment^[5].

These records describe an investment in access and information. A report on a potential target has value to the organization before any weapon is purchased. So does the ability to move a trained person between places. The financial structure behind an overseas operation therefore includes time: the cost of keeping people and capabilities available while instructions, circumstances or opportunities change.

Equipment creates another set of transactions^[9],^[10]. In November 2007, Fawzi Assi admitted trying to board a flight from Detroit to Lebanon in 1998 with GPS modules, night-vision equipment and a thermal camera^[9]. The Justice Department said he was delivering the items to a purchaser for Hezbollah^[9]. His guilty plea concerned material support^[9].

Years later, Usama Hamade’s prosecution exposed a different procurement stream^[10]. He received forty-two months in 2020 for an illegal-export conspiracy involving American technology during 2009–2011^[10]. The goods included equipment suitable for drones^[10]. According to the government’s evidence, Hezbollah was the ultimate beneficiary^[10].

Neither case requires an imaginary suitcase filled with the entire budget of an attack. Their significance is the conversion of access to commercial products into organizational capability. An item can have a legitimate market and still be acquired for a prohibited recipient. The payment, exporter, intermediary and end user may occupy different parts of the transaction.

Matthew Levitt’s 2019 study of procurement describes precisely this parallel system: Iranian assistance alongside companies and brokers acquiring weapons and dual-use equipment^[11]. The distinction matters because state sponsorship does not make a separate procurement network redundant^[11]. Local access, technical knowledge and commercial contacts can supply things that a patron’s direct deliveries do not^[11].

A business can provide more than cash

Treasury’s June 2015 designation of Adham Tabaja illustrated another layer^[12]. It identified him as the majority owner of Al-Inmaa Group for Tourism Works and alleged that his companies supplied financial support and organizational infrastructure^[12]. The account connected commercial activity in Lebanon and Iraq with property, construction and other services^[12].

The same action accused Kassem Hejeij of opening accounts and extending credit to Hezbollah-linked procurement and infrastructure activities^[12]. Credit is consequential here: it can let a business obtain something before the final payment arrives^[12]. Treasury also described a vehicle-supply role for another designated figure^[12]. Its allegations concerned a collection of services, not merely a pile of banknotes^[12].

Hejeij’s lawyer denied direct or indirect Hezbollah links in a contemporary Daily Star report and said Tabaja’s account had been removed after the designation^[13]. The report distinguished the sanctioned individual from the bank, which the announcement had not named as a sanctioned entity^[13]. That response belongs beside the allegation; the commercial relationship was contested^[12],^[13].

For understanding operational finance, the broader implication is straightforward. A network may benefit from premises, vehicles, credit or a supplier relationship as well as from a cash transfer. Asking only how much money an organization receives can obscure the services that help turn available funds into usable capacity.

Gil Riza’s INSS research separates direct organizational commerce, supporters contributing a share of profits and partnerships with criminals^[19]. His discussion of counterfeit trade in Ciudad del Este shows why those distinctions matter^[19]. A supporter’s business, a criminal service provider and a company controlled by an organization are different arrangements, even when their activities meet in the same trading environment^[19].

The mechanism

What has to be paid for

Separate cases show how money and services can sustain operational capacity.

People & readiness

€3,500 / visit

Abdallah’s repeated trips to inspect chemicals in Cyprus, described at his 2015 sentencing. [7]

Equipment & access

GPS · night vision

Assi admitted the attempted 1998 export of equipment for a Hezbollah purchaser. Guilty plea: 2007. [9]

Business services

Credit · premises

Treasury’s 2015 action alleged financial support, credit and infrastructure through businesses. [12]

These examples describe different cases; they are not a traced financing chain for the Burgas attack. [7] [9] [12]

The patron’s money

Iran occupies a different scale in this picture^[14]. A State Department factsheet published in December 2018 estimated annual Iranian support to Hezbollah at approximately $700 million^[14]. That was an estimate of the patron’s contribution, not an audited account of all Hezbollah spending^[14].

In May 2019, American envoy Brian Hook described the same amount as roughly 70 percent of the organization’s operating budget^[15]. He used the estimate to argue that pressure on Iran would constrain Hezbollah^[15]. His formulation left other revenue outside the Iranian contribution, but it did not identify all of that remainder as drug money^[15].

The Congressional Research Service supplied an important explanation for changing estimates^[16]. Its 2019 discussion said the higher figure might reflect either reassessment or increased support during the Syrian war, and described support as fluctuating with shared activity and conflict demands^[16]. The number was a dated assessment of a relationship that could change^[16].

By October 2024, FinCEN was explicitly calling the $700 million figure historical^[17]. Its alert also distinguished donors who might give a portion of illicit proceeds from the criminal organizations or businesses earning them^[17]. An organization’s receipt is not automatically equal to the donor’s revenue^[17].

Hezbollah itself has acknowledged Iranian support while rejecting the criminal-financing account^[18]. AFP reported Hassan Nasrallah doing so in 2012: he described longstanding material support from Iran and argued that it removed the need for illicit funding^[18]. That assertion explains the organization’s public position^[18]. The procurement and laundering cases pose different, specific questions about conduct^[18].

The patron and the other networks can therefore coexist without having equal weight. Iranian assistance can underwrite a large organization while businesses and intermediaries supply additional cash, goods or access. The significance of a smaller channel may lie in where and when its resources can be used, rather than in its share of a global total.

Where criminal proceeds enter

Levitt’s procurement study places a funding squeeze in 2009, reporting a 40 percent cut in Iranian support and describing subsequent diversification^[11]. It is a retrospective analytical account, not a public ledger demonstrating that a particular reduction paid for, or caused, a particular criminal venture^[11]. Its useful question is how an organization responds when a major source becomes less dependable^[11].

The DEA’s February 2016 announcement offered a more direct allegation about criminal proceeds^[20]. It described European collection of drug money, settlement through hawala arrangements in Colombia and a Hezbollah Business Affairs Component^[20]. The agency said proceeds helped purchase weapons for Hezbollah activity in Syria^[20]. That account explicitly connected alleged laundering services to an organizational benefit^[20].

The amounts in another network require a different reading^[21]. Treasury’s 2011 Joumaa designation described laundering volume as high as $200 million a month and named exchange houses and a used-car business in Benin^[21]. Such a volume describes money handled for customers, not the organization’s profit from handling it^[21].

FinCEN’s Lebanese Canadian Bank finding went further on the alleged beneficiary: it said Hezbollah derived financial support from Joumaa’s criminal network^[22]. The finding also described commercial routes involving used cars and consumer goods^[22]. Those propositions identify a claimed connection and a mechanism; they do not supply a measured Hezbollah share of every transaction^[22].

The bank case eventually produced a substantial civil consequence^[23]. The Justice Department announced a $102 million forfeiture settlement in 2013, with another $48 million of previously seized funds allocated to Société Générale de Banque au Liban^[23]. The settlement amount records a legal resolution^[23]. It should not be added to laundering estimates as though it were another year of revenue^[23].

Reading the amounts

Three figures. Three different measures.

The numbers describe a contribution, financial throughput and a legal resolution.

$700mAnnual Iranian support

State Department estimate published in 2018.

Estimated contribution [14]

Up to $200mMoney handled per month

Treasury’s 2011 allegation about the Joumaa network.

Laundering volume [21]

$102mCivil forfeiture settlement

Lebanese Canadian Bank resolution announced in 2013.

Legal settlement [23]

Different periods and measures: these figures cannot be added into a Hezbollah revenue total. [14] [21] [23]

Noureddine’s Paris case, meanwhile, reached a criminal sentence^[24]. AFP reported seven years for laundering drug money and criminal conspiracy, with a €500,000 fine^[24]. That reported outcome establishes the importance of the laundering prosecution without requiring the article to turn the DEA’s separate weapons-financing allegation into a finding quoted from the French judgment^[24].

Together these records make the criminal channel substantive. It is neither necessary to dismiss it because Iran supplies more money nor sound to use it to explain every overseas operation. A broker can earn fees, a supporter can contribute profits and an organization can receive value. Tracing the connection means identifying which of those transactions actually occurred.

Money available, money delivered

After the 2024 war, the distinction between having a financial source and moving its money became more pressing^[30]. Orna Mizrahi’s May 2025 INSS assessment described simultaneous military-rehabilitation and civilian-reconstruction pressures, alongside constraints associated with Assad’s fall and tighter airport control^[30]. More demands were meeting less convenient routes^[30].

Treasury’s November 2025 account nevertheless alleged that Iran’s Quds Force had transferred more than $1 billion to Hezbollah since January, mainly through exchange mechanisms^[26]. It described intermediary Ossama Jaber collecting and converting tens of millions of dollars between September 2024 and February 2025, even as the fall of Assad degraded transfer routes^[26]. The account describes adaptation under pressure, not the disappearance of Iranian funding^[26].

In August 2026, Treasury targeted ten people in another alleged courier network spanning Lebanon, Turkey, the United Arab Emirates and Iran^[27]. Its account described commercial-flight transfers and Turkish exchange fronts managed by Yunus Alper Yilmaz^[27]. The network was significant because it provided movement between places where money was held and places where it was needed^[27].

A smaller event made that problem visible at passenger scale^[28]. Reuters reported the seizure of $2.5 million from an arrival from Turkey at Beirut airport in February 2025^[28]. The Finance Ministry confirmed the seizure; the attribution of its intended destination to Hezbollah came from sources cited by Reuters^[28]. The difference in attribution is essential to what the event shows^[28].

Formal banking access was also being restricted^[29]. Banque du Liban’s July 2025 Circular 170 barred regulated institutions from direct or indirect dealings with specified unlicensed entities, including Al-Qard al-Hassan^[29]. It covered services and arrangements providing access to the banking system, with sanctions for noncompliance^[29]. The regulation addressed the interface between financial systems, where an informal network might otherwise gain formal services^[29].

INSS researchers Noam Binstok, Orna Mizrahi and Esteban Klor distinguish disruption of immediate liquidity from destruction of longer-term income^[25]. Their 2026 account describes decentralized transfers and trade offsets, while separating illicit networks from the largely legitimate diaspora economy^[25]. That framework explains why interrupting one route can be consequential without proving that the whole financial system has stopped^[25].

Back to the name on the card

There is no complete invoice in these records linking the Burgas license to one Iranian transfer or one cocaine payment^[1]. There are, instead, documented expenses, admitted procurement, operational cases, commercial allegations and competing accounts of revenue. Their connections are strongest where a record identifies the person, transaction and recipient together.

An overseas apparatus needs people who can wait, premises that remain available and equipment that arrives when required. The financing challenge is to sustain those things across time and borders. Large-scale patronage and smaller commercial or criminal channels can serve different parts of that requirement.

The false license at Burgas carried a name investigators did not believe^[1]. The FBI’s appeal asked how it had been created and procured^[1]. Behind the borrowed identity was another identity still worth finding: the person who arranged it^[1]. Following that person’s actions, rather than assigning the cost to the largest available revenue estimate, is where the financial investigation begins^[1].

Before the Blast, a Bill

The paid visit

The work before the weapon

A business can provide more than cash

What has to be paid for

The patron’s money

Where criminal proceeds enter

Three figures. Three different measures.

Money available, money delivered

Back to the name on the card

Sources

Related case files

The Case Files Washington Had to Join

Pesos, Dollars and Hawala: Where the Black Market Peso Exchange Meets Beirut

The Shipment and the Missing Name

The Half-Hour Before the Sanctions