The Israeli tourists on Arkia Airlines Flight 161 from Tel Aviv could not have known it, but their arrival in Cyprus last July 6 was watched closely. A pair of trained eyes counted each passenger as the group exited the plane and boarded a shuttle, headed for resorts that had also been carefully studied and mapped.
The bearded foreigner who silently tracked the Israelis was also being watched. When Cypriot police picked him up, the operative for the Lebanon-based militant group Hezbollah acknowledged what he was doing, though he claimed not to know why.
"I was just collecting information about the Jews," he told police, according to a sworn deposition. "This is what my organization is doing, everywhere in the world."
The arrest of Hossam Yaakoub, a Lebanese-born Swedish citizen, on July 7 was all but forgotten 11 days later when a bus containing another group of vacationing Israelis was blown up in the Bulgarian resort city of Burgas. The attack, which killed five Israelis and a Bulgarian bus driver, was quickly blamed on Hezbollah.
Now, seven months after that attack, new details emerging in Yaakoub's case are providing insights into what investigators describe as a far broader effort by the militant group to lay the groundwork for killing Israeli citizens and perhaps others in multiple countries.
Some details have come from Yaakoub, who is accused of planning attacks against Israeli tourists and who made his first public appearance last week during his trial in Cyprus. But a much fuller account comes from legal documents summarizing the Swedish man's statements to police during weeks of questioning last summer and obtained by the Washington Post.
The evidence echoes discoveries by investigators in Bulgaria and prosecutors in Thailand, India, Azerbaijan, Kenya and other countries hit by a wave of attempted assassinations and bombings linked to Hezbollah or its chief sponsor, Iran.
U.S. officials characterize the plots as part of an ongoing shadow war directed by Iran in part to retaliate for Western efforts to derail Iran's nuclear program. Evidence uncovered by investigators portrays a professional, well-funded effort by Hezbollah to recruit, train and position European-based operatives for what U.S. analysts describe as preparations for terrorist operations.
While most of the attacks were thwarted or failed, the accumulated intelligence shows that Hezbollah is learning from its mistakes, employing the tactics of professional intelligence operatives to cover its tracks and expanding its threat, according to current and former U.S. officials, most of whom spoke to the Washington Post on condition of anonymity because of the ongoing nature of the inquiries.
"In the beginning, they clearly traded speed for tradecraft," said Matthew Levitt, a former counterterrorism official with the FBI and Treasury Department and author of the forthcoming book Hezbollah: The Global Footprint of Lebanon's Party of God.
An analysis of the more recent plots shows a shift in tactics, said Levitt, who said the Cyprus case "underscores a very patient, careful and calculated tradecraft."
Testimony and court documents in Cyprus also show that Hezbollah is expanding its network in Europe, recruiting European operatives, conducting surveillance and moving packages to various European cities in preparation for possible future attacks, Levitt and other analysts said.