The criminal project that "Cosa Nostra" carried out during 1993 culminated with the bomb explosion in Rome, in Via Ruggero Fauro on May 14th; the bomb attack in Via dei Georgofili in Florence on May 27th; the Milan attack in Via Palestro on July 27th; the bombings of the Basilica of "San Giovanni in Laterano" and of the Church of "San Giorgio al Velabro" in Rome on July 28th. These very serious episodes are directly connected to another series of bomb attacks which caused bloodsheds in Sicily the year before when the Palermitan Judges Giovanni Falcone and Paolo Borsellino amongst others were killed: Falcone was killed in the Capaci bomb attack on May 23rd, 1992 whereas Borsellino was killed in Via d'Amelio on July 19th of the same year.
Those two dramatic attacks were the triggering events which caused experts to start analysing the very criminal and terrorist acts of Cosa Nostra in 1993. All of them were linked to a single criminal bombing plan, and, according to our law, they are all classified as terrorist crimes, even if they did not all cause the death of people. In fact, the simple fact that such attacks could lead to threaten the safety of an undefined number of people classifies them as terrorist crimes.
These attacks were all carried out in the same way, by using the so-called car bomb. This is one of the objective elements which, besides the motives, derive from a single criminal project. We must notice that investigations carried out on such crimes have pointed out constant analogies between the implementation of the crimes, which forms the basis of a massive bombing activity, and single crime cases. The conduct for each crime reflects Mafia members behavioural methodologies. The events all lead back to a single project both as to the method used and as to the target pursued. Without doubt, most of the criminals who played an important role in the execution of these crimes and in the implementation of a terrorist strategy, all belong to "Cosa Nostra".
Therefore, the analysis of the investigation dynamics leading to the discovery of a Mafia strategy at the basis of these attacks and to the detection of the responsibilities of some members of "Cosa Nostra", is crucial in the study of this phenomenon, which is not new from the investigations' viewpoint, but which had never before reached such a high level of danger. On this occasion though, the institutional answer came in a timely and extremely effective fashion, especially thanks to similar past experiences. We can in fact, today, speak with full knowledge of principals and motives and with enough certainty we can also speak of the executors and implementation procedures. This is probably due to a specific situation characterising the investigation as a whole. As the investigations led to the acquisition of objective elements, each element was screened, re-examined, reviewed and valued within the organised crime framework already known to investigators in general, more specifically within "Cosa Nostra" . The information resulting from previous investigations, further increased after the bombing attack in Capaci and Via d'Amelio, and also after the confessions of several supergrasses, led to a clear-cut reference scenario resulting in the reconstruction of the criminal cliques, but also to the ability to interpret internal dynamics, the mental process and the behavioural sharpness typical of Mafia members. This wealth of knowledge which was gradually updated by further investigations, was like a test bed for the tiniest clues, giving the investigators' activity a stringent rationale and a permanent effectiveness.
In this respect, we must consider the different elements of the investigation pertaining to what we shall from now on call "attacks", in order to better understand the uniformity of the strategy and the organisation of "Cosa Nostra".
First of all, we must point out that the technical evaluation on explosives used provided relevant information. The highly sophisticated equipment used to detect the explosive debris left from the five car bombs has led to considerable quantitative and qualitative analogies between the explosive charges. The first important analogy of crimes concerns the components. The examination of the bomb debris revealed the presence in all five charges of the following substances: trinitrotoluene, penthrite and T4, as well as quarry gelatines (for civil applications), such as nitroglycerine (NG), ethylenglycoldinitrate (EGDN) and dinotrotoluene (DNT). The special composition of the mixture and its weight have determined further analogies between the bomb attack in Via Ruggero Fauro and the attack in Via d'Amelio on July 19th, 1992, as well as with the previous Mafia bombing of the 904 Naples-Milan Express train on December 23rd, 1984 for which the well-known Pippo Calò, until some years ago one of the major representatives of "Cosa Nostra", was condemned.
Further mention must be made of the fact that in all five attacks the car bomb technique was used: the cars used had been stolen shortly before (just five hours before in Via dei Georgofili) and, in four cases out of the five, they were FIAT Uno car models (except for Via dei Georgofili where a FIAT Fiorino was used probably because of the greater quantity of explosive and amount of damage they wanted to cause).
The car bomb technique which brings us back to the bomb attack in Via d'Amelio, in Palermo and to other attacks from Mafia organisations, is an important common element, whereas the short time elapsing between the car thefts and the explosions puts emphasis on the carefully planned and previously tested procedures. It also reveals the existence of a well-established and widely spread organisation in the towns where these attacks took place and capable of moving in these large urban areas with great precision and accuracy and, above all, unnoticed if we fully consider the complex sequences necessary to carry the explosive charges, place them in the stolen cars and park the cars close to the chosen target.
A further common element for four out of the five attacks (excluding the bombing in Via Fauro, which as we shall see later on, had a specific target, consistent with the same criminal mind in subject) is the co-existence, alongside the typically strategic-terrorist target (killing and spreading panic without aiming at individuals chosen because of their specific roles), of targeting the attack towards the historical-cultural heritage of the country: the Uffizi Gallery in Florence, the Contemporary Art Pavilion and the Modern Art Gallery in Via Palestro, S. Giovanni in Laterano and S. Giorgio al Velabro in Rome.
The analysis of the evidence leading to the responsibility for each single blast has produced a series of elements leading to the discovery of further links between the attacks, both from the subjective and the objective viewpoint. Alongside the technical-chemical evidence and the usual investigation methodologies leading to the reconstruction of the crime, as well as the analysis of the circumstances before and after the attacks, relevant to the investigations, a special activity was carried out which had already proven successful in the investigations on the 1992 bomb attacks: tracking mobile phone conversations. Let us make the following assumptions: the authors of the crime were probably several people operating from areas away from the scene of the attack and had to communicate before and after each bombing; they must have had direct and continuous contacts with their criminal accomplices in Sicily; their permanent and integrated operational headquarters in Rome, Florence and Milan must have called in other individuals from Sicily; all of them or just a few must have used mobile phones. A list of useful phone calls made with mobile phones was examined.
The Italian telephone company, Telecom, keeps a single electronic data base on mobile phones for accounting purposes with the following information: telephone number dialled; date, time and duration of the call; telephone district of the caller; specific cell which picks up the signal coming from each mobile phone in a limited area. For example, in Palermo and in the neighbouring area almost 20 cells are operating. Each cell covers an area which varies according to the holeographic conditions favouring or preventing the transmission of electromagnetic waves. Therefore, in the town areas at different heights, there is a higher number of cells compared to a flat and poorly populated area.
Telecom's electronic files have enabled the collection of data on mobile phone conversations in a limited time frame between the attack itself and the crucial times resulting from the investigations: for example, the car theft or the placing of the car in the area of the attack. Numerous users were selected and then left out of the investigations. At the same time, as the investigations provided fresh evidence, logical conditions were determined for the targeted tracking and analysis activities on the data base which kept updated with all the telephone conversations and callers.
A few examples will explain how we operated. As the car used to hide the explosive was stolen at a certain time and as the explosion occurred at a different time, phone users having a conversation during the time of the theft (normally not over 20 minutes) were checked to see whether they were also using the phone during the explosion, or whether during the two phases one same phone had been called by two different callers, or, if one phone had called another during the time of the theft and in turn the latter had been called at the time of the explosion, or else all phone calls had been made before and after each fact, and so on.
Obviously as the electronic file system comprises seven million "records" approximately, the analysis was essentially focused on reducing the number of users to a few cases which could be linked to other parts of the investigations or support each investigation separately. This data base, which is kept updated with all the evidence resulting from wire-tapping activities relating to the same area of investigation, also presents other points. In fact, the collected data included the names of all the people who stayed in Rome, Florence and Milan hotels during the days of the bomb attacks, as well as the names of people who rented a car in the same towns or who flew to and from Sicily in dates compatible with their possible involvement in the planning and implementation of the attacks.

The information data processing was crucial for the investigations relating to the attacks, especially due to the importance of tracking the mobile telephone conversations with great accuracy. The possession of a mobile phone of each investigation suspect was examined and often the phone was not under his own name; sometimes it was a "cloned" phone, which is a device that uses the serial number of somebody else's mobile phone (the user might even be aware of the fraud).
The tracking activity of these telephone numbers, not always possible by reference to the phone directories or by tracing the phone number when the user called from his mobile phone, a phone sometimes belonging to a wanted person, depended on the processing of the telephone data. The personal relationship conversation network of each user was set up to find out which number had been used and track the telephone calls of each user. For example, when one needs to trace a number, a detailed check is made on the mobile phones which most frequently call certain home numbers of parents, brothers and sisters or girlfriend of the suspect, etc. Once the mobile phone call list is complete it is possible to sketch an approximate user profile, according to the characteristics: type of people contacted, time of the calls, place of call, most frequent phone numbers dialled. This technique enables the phone calls made by the legitimate user to be distinguished from those made by means of a clone. It must be said that this tracking activity has a merely indicative value in the investigations, and except for some specific cases, it is not to be considered constraining. For example, once a cloned phone has been detected, knowing that the legitimate user only used it rarely, we checked whether one of the numbers called through the clone had ever been wire-tapped. We then got the tape with the recorded telephone conversation on it, which in that specific case had not been useful for the investigations, and the voice of the person using the cloned phone was identified. Either through telephone comparisons or through the identification provided by supergrasses, as a probative element, a name was given to the user of the cloned device.
This explanation of mobile telephony is essential to clarify how we concretely extended our investigations on the bomb attacks which are essentially based on two key elements: statements made by supergrasses and tracking of mobile calls.
Before providing a description of the various phases of the investigation, we must briefly reconstruct the five bomb attacks:
- At 21.37 hrs of the 14.5.1993 in Via Ruggero Fauro, in Rome, in front of number 62 of the same road, a car loaded with an explosive mixture of penthrite, T4 and trinitrotoluene exploded. The explosion occurred while a car was going passed with the journalist Maurizio COSTANZO and Maria DE FILIPPI on board. The blast caused various injuries and considerable damage to nearby cars and buildings. The explosive charge had been placed inside a Fiat Uno, stolen in Rome between 19.00 hrs of May 11th and 05.00 hrs of May 12th 1993.
- At 01.02 hrs on 27.5.1993 in Via dei Georgofili, in Florence, a car carrying an explosive mixture of penthrite, T4 and trinitrotoluene exploded. The blast caused the death of 5 people and wounded 37, as well as badly damaging the Georgofili Academy, the Uffizi Gallery and nearby buildings and parked cars. The explosive charge had been placed inside a Fiat Fiorino, stolen the evening before in Via della Scala, in Florence.
- At 23.14 hrs on 27.7.1993 in Via Palestro, in Milan, a car carrying an explosive mixture of penthrite, T4 and trinitrotoluene exploded. The attack killed 5 people and wounded 13, as well as destroying the nearby building of Contemporary Art and the cars parked. The explosive charge had been placed inside a Fiat Uno, stolen in Via Baldinucci, in Milan on 23.7.1993.
- At 00.03 hrs on 28.7.1993, in Rome, in the square opposite the Vicariate in Piazza S. Giovanni in Laterano and at 00.08 in Via del Velabro, two car bombs exploded in which an explosive mixture of penthrite, T4 and trinitrotoluene had been placed. In both bomb attacks the blast damaged nearby buildings and cars. The explosive charges had in both cases been placed inside Fiat Uno cars, stolen in Rome; the first Fiat was stolen on July 26 and the second between July 26 and 27 1993.
The first important evidence for the investigations relating to Via Ruggero Fauro, was yielded by the witnesses who made it possible to detect the presence of a dangerous wanted criminal belonging to the Mafia family of the Brancaccio, seen in the street shortly before the attack. As to Via Georgofili, evidence was provided by the established presence in Florence hotels of recognised Mafia members that could easily be related to the stolen Fiorino used to contain the car bomb. As to Via Palestro, the evidence resulted from the direct link of Mafia members with another Mafia suspect arrested in the Novara area for stealing a Fiat Uno the day before the blast, who was found with a mobile telephone number generally used by another criminal belonging to the Mafia group headed by the Via Fauro fugitive. The same person had also contacted a Milanese phone number that many representatives of "Cosa Nostra" called. For San Giovanni in Laterano and San Giorgio al Velabro, the evidence was provided by the positive examination following the statement of a supergrass.
The investigation clues found at different times and developed through targeted investigations, have gradually enabled us to enrich the investigation scenario with the sources of evidence leading to determine the responsibilities for each criminal attack and to reconstruct the various links between the different crimes not only from the objective viewpoint, such as the technical-explosive examination, but also from the subjective one, establishing the presence of criminals in the place of the attack or defining the operational links between each other. The detection of an individual's presence in a specific place after some time had passed was also made easier by the mobile phone tracking system. Even the contacts among the various individuals which lead the five bomb attacks back to the same context were favoured by the same analysis.
We must also add that the investigation carried out by specialised bodies in organised crime like the D.I.A., the S.C.O. and the R.O.S., together with the territorial investigation units, was well co-ordinated both when the District Anti-Mafia Attorneys involved were three, one for each individual attack with respect to their territorial authority, and when they were all uniformed at the Florence District Power of Attorney where the most serious car bomb had been placed causing a number of deaths.
Such complex and difficult investigations required a co-ordinated management which went through various phases. First of all, the central bodies of the State Police and the Carabinieri centralised information collected locally in Rome, Florence and Milan setting up the first data exchange point, to which later on the D.I.A., joined in after having determined the implication of the Mafia in these attacks. During this phase, the various District Attorneys were all connected and co-ordinated by the National Anti-Mafia Administration. The data collected on the mobile phone calls, on the presence in the hotels in the towns where the attacks were made, the car renting and the list of passengers on flights to and from Sicily, was immediately entered into the State Police Central Operational Unit data base, which processed the information according to the demands from the investigating bodies. Having moved onto the final phase of the first part of the investigations, the criminal police organisations produced a single working document which they made available to all district Attorneys concerned, who in turn, in the mean time, had set up a re-unification procedure of the five criminal episodes with the Florence district Attorney.
Before examining the various difficulties in the investigations concerning the 1993 bomb attacks further, we need to provide some common basic information which led the investigating bodies to favour the assumption of a common "Mafia matrix" and the Criminal Authorities to unify all of them into one single crime.
On January 31th, 1992 the Corte di Casszione recognised "...the existence of a criminal organisation marked by a hierarchical structure", stressing that the "criminal association is divided into well-defined organisational schemes characterised by hierarchical groups, in turn co-ordinated into aggregating systems headed by a centralised management system....". This decision confirmed the accusation assumption of the so-called Palermo maxi trial, proclaiming many permanent sentences.
The heads of "Cosa Nostra" fully understood that this sentence knocked down a fundamental milestone for the survival of the very organisation, representing an unquestionable sign towards the end of a system, which for a long time had guaranteed impunity.
It was quite obvious that the court decision on the existence of "Cosa Nostra", but also on the principle of responsibility of its government body for the so-called "top level crimes", had led to the collapse of the system of collusion, connivance and co-interests in business profit-sharing, which had guaranteed its existence over the years.
On March 12 1992, during the campaign for the political elections of April 5 and 6 1992, the Member of Parliament Salvo LIMA was killed in Palermo; he was considered to be the political contact person of "Cosa Nostra", linked to Ignazio SALVO, already sentenced for Mafia criminal association.
The killing of the Euro MP marked the beginning of "Cosa Nostra's" military campaign and killings of statesmen committed through real terrorist attacks aimed at causing social outcry.
May 23rd of the same year, witnessed the bomb attack in "Capaci" and July 19th the attack in Via d'Amelio.
The time choice however, to kill Judge Borsellino caused many doubts. In fact, the bomb attack was made while new anti-Mafia initiatives were being discussed, this meant a speeding up of the process and the swift enforcement of strict measures.
In the absence of pressing urgent reasons, "Cosa Nostra's" behaviour, always careful not to force the State into adopting stricter measures, appeared unusual. Consequently, we perceived the willingness to pursue goals not yet clearly defined from the probation viewpoint, but certainly of such importance that required significant sacrifices, especially if we consider them essential for the very life of the organisation.
In fact, immediately after the bomb attack in Via d'Amelio the State had a very strong reaction. Once the initial restraint was over, new rules were issued, with particular emphasis on the introduction of Art. 41 bis of the Penitentiary Law and a more effective action was aimed at favouring the phenomenon of "supergrasses".
From September 19, 1992 to May 14, 1993 (murder of Judge BORSELLINO and bomb attack in Via R. Fauro) what seemed to be a never-ending strategy came to a hault, only to be interrupted by the murder of Ignazio SALVO in September 1992, as a logical consequence to the murder of Salvo LIMA.
Probably, the effects of the State's reaction after the murder of Judge BORSELLINO had been much greater than the expectations of "Cosa Nostra", which probably had not taken into due consideration the severe limits on communication imposed on prisoners, thus hindering the usual contacts preceding any criminal decision.
In February - March 1993, we noticed the first signs of a renewed tendency to the use of bomb attacks with explosive charges, and on May 14, 1993, only 14 months after the bomb attack in Via d'Amelio and Via Ruggero Fauro, in Rome, a car bomb exploded while the journalist Maurizio COSTANZO was passing by.
On May 27 1993, only two weeks from the bomb attack in Via Ruggero Fauro, a car bomb placed in the historical centre of Florence exploded causing the loss of many innocent lives and seriously damaging the town's cultural and historical heritage.
The criminal action was different from the one in Via Ruggero Fauro, because the target was not a specific person, the aim was to stir public opinion more towards the fame of the cultural heritage than to the number of casualties that the attack would cause. In this circumstance, the repeated use of a car bomb led to assume that the bomb attack in Via Ruggero Fauro and that of Via dei Georgofili were both part of the same criminal mind.
The sequence of attacks continued in Milan and Rome on July 27 and 28, 1993.
The use of the car bomb, an exquisitely technical datum typical of a "modus operandi" repeated five consecutive times with analogies also in the quantity and composition of the explosive charge involved, convinced us even more that we were facing a terrorist plan, conceived within a single strategy design.
During the analysis, attention once more focused on Mafia organised crime particularly on "Cosa Nostra" and similar associations linked to it, without discarding a priori any other possible matrix.
In fact, various points had been noticed such as the repeated attacks on supergrasses and the growing atmosphere of impatience in prisons due to the limitations enforced by Art. 41 bis of the Act on Penitentiary Law. These signs all matched up with the repeated statements of supergrasses, who were informed of the existence of mass killing projects within "Cosa Nostra" and other organisations, and with further confidential information obtained by investigators from people inside the Sicilian organisation, confirming that the bomb attacks had been decided and then implemented by "Cosa Nostra" itself. The aim was to destabilise the State forcing it to loosen its hold on supergrasses and the enforcement of Art. 41 bis.
Promptly carried out investigations led to the gathering of relevant elements confirming the Mafia matrix of the bomb attacks and mainly verified by confidential information. The evening of the bomb attack in the Tuscan county town, recognised members of "Cosa Nostra" slept in Florentine hotels; their presence in Florence immediately gave rise to suspicion, because the Fiorino was stolen in a parallel street to that of the hotel, and because the motives and circumstances of their stay in the city appeared to be a pretext; finally, because one of the suspects is linked to the Mafia "family" of "Cosa Nostra" headed by the MADONIA of RESUTTANA, well-known "Cosa Nostra terrorists". In fact, the season of bombings by "Cosa Nostra", a series of bomb attacks all organised with car bombs in Palermo thirty years before, goes back to this family.
Confirming the intentions of "Cosa Nostra" to organise attacks against the national, historical and artistic cultural heritage, were the statements of a prisoner, who after the bomb attack in Via d'Amelio, had acquired the information that the Mafia was planning attacks against symbols of the national cultural heritage.
Further statements from supergrasses explained "Cosa Nostra's" attack strategy targeted towards the following goals:
a) discourage the law on supergrasses' co-operation and eliminate their reliability;
b) abolition of the prison inmates' restrictions following the introduction of Art. 41 bis;
c) lighten the position of members of criminal organisations while trials are still in progress.
At the same time the point that emerged was that "Cosa Nostra's" intimidating strategy, while aiming at symbolic targets so well known that they insured themselves the maximum coverage, was also aimed at attacks upon those individuals considered greater threats to the organisation. Therefore, we have an example of this plan with the above-mentioned car bomb attacks against Maurizio COSTANZO and the murder of Father Giuseppe PUGLISI, Parish priest of the "Brancaccio" district, which has been attributed to the "Graviano" family.
The involvement of the Brancaccio family, headed by the GRAVIANO brothers, is revealed by various eyewitnesses confirming the family's direct participation in some of these attacks and demonstrating the direct involvement of high-ranking members of "Cosa Nostra", in "Corleonese" style. This is a point of particular interest, if we bring to mind that when extremely important crimes are committed, so-called "top level crimes", high-ranking members of Cosa Nostra intervene directly, even when their functional role is marginal. We can take for example, the murder in Palermo of Dr Ninì CASSARÀ, Palermo Police Official in August 1985, who together with his driver was gunned down in the street by men with kalashnikovs, in the presence of two ill and elderly family bosses, Francesco MADONIA and Giuseppe GAMBINO. The two bosses played no active role in the crime, but their presence on the scene made their responsibility clear to the whole of "Cosa Nostra".
The proved presence of members of the Brancaccio family with reference to the 1993 attacks, is based on photographic reconnaissance made from eyewitnesses, who were only shown photographs of suspects after the investigation findings proved it necessary. This stage was reached by checking calls made by owners of mobile phones. Evidence became crucial when strong co-relations with a Milanese branch of "Cosa Nostra" were identified. This branch had already shown considerable interest in attacks planned for March 1993, thwarted thanks to the arrest of one of the saboteurs who has recently started to co-operate.
Once again, crucial to the investigations, was the information gained by tracking mobile phone calls made by suspects who aroused the suspicion of the investigators concerned. In fact, evidence of their presence in these hot areas or contacts established with suspect individuals, was gained by the investigating bodies in similar criminal circumstances, but for different crimes. All this has helped us to value elements which up to now have slipped the attention of the investigators, who without the necessary facts were unable to give them appropriate consideration. When the link finally emerged leading to a re-examination of the acquired and then discarded investigation material, crucial elements regarding bomb attacks then became worthy of the utmost attention.
Co-operation provided by an ex-convict from Palermo, arrested in Rome in 1994, was the decisive point in detecting the vital phases for the preparation of the bomb attacks taking place in Rome on July 28 1993. So the investigation framework, thanks to the logic linking the various attacks and confirming that the planning and operational responsibility is one alone, has reached a summing up point: although incomplete, we are now in possession of a much clearer picture related to the problem of bomb attacks. We are far from the end of the road, a lot has still to be proven and not all positions are clear. What is quite obvious is that, on one hand we have sources of evidence, generally of a testimonial nature, dating back to "Cosa Nostra's" terrorist plan for the 1993 bomb attacks, and on the other, definite evidence has been produced concerning the involvement of Mafia members, some of which occupy leading positions in their organisation. Their presence alone, plus the investigation data collected, is sufficient evidence to prove "Cosa Nostra's" involvement in the five bomb explosions which took place in Rome, Florence and Milan in 1993.