Abstract: Judging by the number of plots and attacks hatched by Syrian returnees, the Islamic State’s francophone cadre appears to be the most active of the organization’s Western contingent. Often operating together in Syria, a number of these recruits showed an early proclivity toward striking their home country. The peer dynamics of the group provided the Islamic State with a valuable pool of determined recruits, which would prove crucial in the development of the organization’s external operations capacity. These factors led to a sustained tempo in terrorist activities in France and Belgium from early 2014 onward, culminating with the mass casualty attacks in Paris and Brussels.
A year ago in November, an Islamic State cell killed 130 in Paris in the deadliest terrorist attack in modern French history. Four months later, the remaining members of the cell killed 32 at the Brussels airport and metro. As investigations into the attacks proceeded, it soon became clear that most of the perpetrators, planners, and ringleaders of this Islamic State terror campaign were not foreign operatives, but mostly French and Belgian nationals who had grown up in the countries they attacked.
This article outlines what the investigations have uncovered so far about the francophone Islamic State network behind the Paris and Brussels attacks, as well as earlier attacks and plots, by drawing on court documents and judgments related to multiple European terrorism cases. It draws on interviews with European and American counterterrorism officials as well and a database on French foreign fighters maintained by the Center for the Analysis of Terrorism (CAT).
The Islamic State’s francophone cadre has plotted and executed more attacks on European soil than any of the group’s other contingents of Western foreign fighters.1 This has partly been a function of the large numbers of French and Belgiansa who have been recruited into the group, in addition to the Islamic State senior leadership’s focus on targeting France, as voiced by the group’s late spokesman, Abu Muhammad al-Adnani, in September 2014.2
The Original Cluster: Katibat al-Muhajirin
In Syria, since 2013, French and Belgian militants from a variety of networks quickly came to socialize by sharing housing and fighting in the same units. Owing to this overlap, it should come as no surprise that the French-speaking cluster involved in the Islamic State’s external operations developed strong interpersonal ties, sometimes building on kinship that pre-dated the Syrian jihad.
The Katibat al-Muhajirin (KAM) in particular was a magnet for francophone volunteers to the Syrian jihad. Composed mainly of Belgian and French jihadis, as well as a few Dutch and Germans, and based in northwestern Aleppo, KAM formed the foreign detachment of Majlis al-Shura al-Mujahidin, whose leader, Amr al-Absi, became the Islamic State governor of Aleppo after throwing his support behind Abu Bakr al-Baghdadi in mid-2013.3 Among KAM’s key figures were its first leader, Houssien Elouassaki, a former Sharia4Belgium follower, and Chaquir Maaroufi, a media-friendly French jihadi best known as “Abou Shaheed.”4
While fighting in Syria, a number of KAM members expressed an early interest in external action and/or ostensibly praised those who had conducted such operations, notably Mohamed Merah who perpetrated the March 2012 Toulouse and Montauban attacks.5 According to Zakaria Amzil, a French foreign fighter who returned from Syria, part of the cluster was inclined to return home to undertake terrorist activity and had been trained for this purpose. Some of them, he added, even took care to conceal their identity and appearance on social media, in case they ever returned to Europe.6
One of those supportive of launching attacks was Tyler Vilus, a French convert who reportedly left for Syria with Maaroufi. In August 2013, Vilus publicly urged his French followers to launch attacks at home, especially by targeting police stations and personnel.7 Others in KAM not only supported jihad inside Europe but had been linked to plots on French soil prior to their arrival in Syria. For instance, a comrade of Vilus named Rached Riahi took part with others from the “Cannes-Torcy network”b in scouting military targets in southern France during the summer of 2012.8
Early Attack Plots
The KAM anti-Western current soon translated into attack plots being mounted by a handful of its alumni. In January 2014, Ibrahim Boudina and Abdelkader Tliba, both previously part of the Cannes-Torcy network, returned to Europe, following similar itineraries and carrying an identical amount of cash with them. Boudina brought a bomb-making manual and a list of contacts, including militants he met in Syria, as well as instructions on how to communicate securely. Before his arrest in Mandelieu-la-Napoules in southern France in February, Boudina had built triacetone triperoxide (TATP)-based explosives devices, acquired a gun, and researched a range of potential targets, including military bases, the Jewish Defense League, Charlie Hebdo, and a carnival. It has been reported that the Nice carnival9 was the ultimate target chosen by Boudina.10
Mehdi Nemmouche, a French extremist who arrived in Syria in December 2012, was also part of KAM and, according to Amzil, belonged to a group led by the Belgian terrorist operative Abdelhamid Abaaoud whose aim was to commit terrorist attacks in Belgium.11 He left the country around the same time as Boudina and Tliba, with whom he was apparently well-acquainted.c Once in Turkey, on January 16, 2014, he was called from Belgium by Abaaoud, who was himself a KAM member and would later play a key role in the Paris attacks. Earlier that day, Nemmouche had tried to contact Dniel Mahi, another KAM alumnus also then in Belgium and a close friend of Abaaoud.12 After a circuitous journey throughout Southeast Asia, Nemmouche spent several weeks in Molenbeek before his attack against the Jewish Museum of Brussels in May 2014, the first successful one carried out in Europe on behalf of the Islamic State.13
Although the above-mentioned Syrian returnees were all Islamic State members, the level of organizational command and control remains difficult to assess. In addition to the absence of any official claim of responsibility, it is also worth noting that Nemmouche complained about the lack of support he faced upon returning from Syria.d
In any case, it appears that, by late 2013, the Islamic State had already started building the machinery to launch external attacks, as assessed, for instance, by Dutch intelligence.14 A returned French jihadi, Mourad Fares, recounted that a prominent figure involved in building up the group’s external attacks capability was Abu Usama al-Madani, a senior Saudi leader running the Islamic State’s foreign fighters affairs. As such, al-Madani handled the recruitment for a secret training program to dispatch volunteers back home for operational purposes.15
The account of Nils Donath, a German extremist who at one point joined the Islamic State’s security-intelligence apparatus (amniyat), further indicated that the organization envisioned striking the “far enemy” on its own soil, before declaring a caliphate. Donath told interrogators after his return to Germany that during the first half of 2014, recruits could add their names to a list of those willing to perform external work.e
Growing Ambition
While the cases outlined above point to an early interest in striking the West, it appears the Islamic State only truly institutionalized and invested in an external operations wing in the second half of 2014,16 leading to its first large-scale and centrally directed action in Europe with the “Verviers” plot. Preceded by an open threat against the West from the group’s senior leadership in September of that year,17 the plot was thwarted after a firefight with Belgian commandos in the eastern Belgian town in mid-January 2015. The alarm created in Belgium was celebrated at length by Abaaoud via official media channels roughly a month later, indicating an organizational undertaking.18
Aimed against law enforcement, the project gathered a predominantly Belgian-French web of militants, most of whom had had jihadist experience in Syria. In Belgium, the groundwork was laid by the Moroccan Souhaib el-Abdi and the Pakistani Mohammed Hamza Arshad Mahmood Najmi, who both returned via Turkey in early October 2014 after roughly a month in Syria. Together with Marouane el-Bali, el-Abdi’s closest friend, they tapped into their social network to acquire forged documents, weapons, ammunitions, and police uniforms. Despite their own strong suspicions that they were under surveillance, the trio went on to rent a safe house and several cars, stockpile weapons and ammunition, purchase chemicals, and drive to pick up Belgian Khalid Ben Larbi and Sofiane Amghar in France and Germany, where they had just arrived from Syria, and bring them back to Belgium.19
Turkey and Greece were used as major facilitation and command hubs for the plot. A group of French operatives who were also selected to participate in the planned attack used Greece and Turkey as gateways to return from Syria. All belonged to the “Trappes network,” a cluster of extremists from the eponymous town 20 miles southwest of Paris. Among them was Walid Hamam, a KAM member who posed as a Syrian refugee in Greece.20 He had previously been part of an external operations network in Lebanon in which Abu Muhammad al-Adnani, one of the group’s then top leaders, and Chaquir Maaroufi were also involved.f Another important figure in the Trappes network based in Greece was Wissem el-Mokhtari, who was close to Hamam, as well as Foued Mohamed-Aggad, one of the Bataclan assailants.21
Le Bataclan in Paris in October 2016 (Bernard Menigault/Corbis via Getty Images)
Operating from Turkey and then Greece, Abaaoud emerged as a leading figure in this French-Belgian network, directly supervising the deployment from Syria and reception in Western Europe of the Verviers Islamic State attack team, as well as providing them with operational guidance. Unable to return to Belgium, Abaaoud maintained extensive communications with his accomplices there and played a central and dominant role in coordinating the Verviers cell’s activities, from operational security issues to division of labor. Additionally, he acted as a key node between Europe and Syria by relaying instructions from the Islamic State’s upper echelons to the cell and updating the group’s headquarters about their overseas operatives’ activities. Besides the Syrian-Turkish region, Abaaoud also reported to contacts in Libya, notably discussing financial and travel issues of the Verviers cell’s members.22 It should be noted that Abaaoud and his two acolytes, Ben Larbi and Amghar, were affiliated to Katibat al-Battar, a Libyan-dominated Islamic State battalion, which by 2015 had sent hundreds of fighters back to Libya to build up the group’s presence there.23
A Broad Recruitment Campaign
Following the Verviers plot’s failure, the Islamic State made clear there would be no let-up in its commitment to target the West, with al-Adnani warning that “what lies ahead will be worse … for you haven’t seen anything from us just yet.”24 Besides sharpening its anti-Western rhetoric and issuing operational advice to its sympathizers through its media outlets, the group also mobilized its core members for a campaign of attacks in Europe. In the spring of 2015, for instance, foreign recruits attended a Friday sermon in Raqqa delivered by Mohamed Mahmoud, a notorious German militant figure, during which he advocated attacks against Germany and portrayed jihad in Europe as a duty.25 Several accounts from Islamic State militants detained on their return by European security services indicated the Islamic State was intensifying its external attack planning, with onetime French recruit Reda Hame describing their efforts in and around Raqqa in June 2015 as a “real factory.”26 According to these accounts, willing candidates could sign up for external operations, mirroring the procedure described by Fares and Donath.27 According to one Islamic State returnee, francophone recruits proved the most eager to strike home, while German and British members expressed more reluctance.28
In planning attacks, the Islamic State’s external operations wing underwent a vetting and approval process, based on its enlisted volunteers’ files, to identify suitable recruits for its terrorist plots. For instance, close attention was paid as to whether a candidate had a media profile or was wanted at home, even though numerous operatives eventually selected were already known by their home country’s security services.29 It appears that the amniyat (security service) led these efforts, with some of its operatives entrusted with facilitating and planning attacks overseas.30 The Islamic State itself hinted at the central role of this security body when referring to its clandestine operations outside of its Syrian-Iraqi territory. In its statement claiming the March 2016 Brussels attacks, for example, the Islamic State characterized the suicide-bombers as part of a “security detachment” (mafraza amniya) of the group.31
It is worth noting here that a number of French and Belgians involved in external operations have also served as intelligence and security assets for the organization. Perhaps the most prominent French Islamic State member, Boubaker el-Hakim, a veteran French-Tunisian jihadi, was said to hold a senior position in the amniyat and to maintain a relationship with al-Adnani.32 Two other security operatives, the French Salim Benghalem—a close associate of el-Hakim and widely believed to play a role in foreign plots—and the Belgian Najim Laachraoui—the bomb-maker of the Paris and Brussels attacks and previously part of KAM—were known to enjoy the trust of the group’s upper echelons.33 Together with their comrade Nemmouche, Benghalem and Laachraoui acted as captors to local and Western hostages in Aleppo.34 Other Belgian and French jihadis, like Vilus, also worked in the amniyat.35
While French and Belgian militants proved particularly active in international plots, they still had to report up the chain of command. Abaaoud did not act on his own in the Verviers plot, for example, and in another case, he told French Islamic State recruit Hame, whom he groomed in Syria, that he had to wait for his emir’s feedback before moving forward with the plan.36 According to Nicolas Moreau, a French Islamic State defector, Abaaoud’s supervisors included two Tunisians who had the final say over the vetting process and dispatch.37 Several Tunisians appear to have held a senior role in the group’s external operations wing. For example, a Syrian operative sent to participate in an attack in Dusseldorf, Germany, contended that he knew his operational leader as Abu Dujana al-Tunisi, also dubbed the “emir of the foreigners.”38 Al-Adnani was likely the highest-ranking leader directly involved in approving foreign attacks.39
Figure 1: The Paris-Brussels Attack Network Dispatched from Syria
Quick Training and Deployment
During the first half of 2015, the Islamic State took a new approach in trying to get an attack through in Europe: quickly training and dispatching fresh recruits in Syria back to Europe, instead of sending experienced fighters as in the Verviers plot. Given that these recruits primarily came to join the Syrian jihad, personalized attention was given by senior operatives within the external operation wing to redirect them away from their original goal. This approach was notably discussed by Harry Sarfo, a German Islamic State recruit who was detained in July 2015 on his return to Europe. Sarfo traveled to Tal Abyad, Syria, in April 2015 and shortly after, he claimed he was courted there by two Frenchmen who worked in the amniyat and asked him if he would consider returning home to undertake an attack. When Sarfo replied that that was not the reason he had come to Syria, he was told that the organization did not need more European recruits at that point and that jihad instead must be launched in the West.40
Although Sarfo claimed to have declined the offer, other newly arrived recruits ended up in plots on French soil after interacting with a small number of external operations personnel who managed to “sell” external action to them.
One of these was Sid Ahmed Ghlam, an Algerian national who is presumed to have spent time in Syria in October-November 2014 and then in February 2015. There, the engineering student is believed by investigators to have linked up with a handful of French-speaking militants—including Abdel Nasser Ben Youcef, a seasoned Algerian jihadi once active in Afghanistan and the Caucasus, and two Tunisian jihadis. Obviously interested in Ghlam’s profile, these militants approached the wannabe fighter to convince him that his duty was to help the Islamic State strike France, playing on a narrative of revenge against coalition airstrikes in Syria and Iraq in which terrorism in the West is framed as a necessary retaliation.41
In another case, the French recruit Reda Hame traveled to Syria in early June 2015 as he considered it his duty to make his hijrah (emigration) and fight there. As soon as he arrived in Syria, Abaaoud attempted to recruit him for an attack in Europe. Abaaoud first asked the newcomer if he would be inclined to strike abroad, before pitching to him the virtues of this type of operation to make him more receptive to the idea. As part of his hard sell, Abaaoud argued that Hame would obtain the rewards of two martyrs and that if he had the proper papers to travel, he himself would have performed such an action, even against his emir’s will. Additionally, Abaaoud showed Hame the damage caused by the coalition airstrikes in Raqqa to underline how “lucky” he was to be able to take revenge at home instead of staying in Syria.42
To avoid raising suspicions at home, these fresh recruits were to be deployed as soon as possible to make it seem like they had just spent some time on holiday in Turkey.43 Consequently, they did not follow the standard training curriculum and were not tested on the battlefield, but instead underwent rudimentary weapons training. In addition to operational security training, they were also schooled in communicating and storing information securely to avoid detection once in Europe. Ghlam, for instance, relayed that he was taught by a francophone, computer-savvy operative nicknamed Abu Omarg how to use encryption tools, including software like PGP, to send and receive messages and files, which he did abundantly upon his return to France.44
Before their departure from Syria, the selected recruits and their handlers agreed upon communication protocols to maintain contact, which involved creating several online accounts and sharing access to them. Multiple email addresses were used for the planned attack by Ghlam, with the latter also creating a Skype account to maintain communication back to base. It is worth mentioning that at least one of Ghlam’s handlers used the same alias (Amirouche) of an external operations figure involved in the Verviers plot, thus raising the possibility of a nexus between these plots. As for Hame, he was given the Turkish cell number and online contact of Abaaoud who instructed him not to call from Turkey but instead wait until he reached Prague.45
During their short Syrian stay, the selected operatives and their handlers also discussed types of targets and outlined the parameters of the attacks, even though operational details remained to be determined in the latter stages of the plot. If the Verviers cell targeted security forces, subsequent planned attacks suggest that external operations personnel then heavily focused on civilian targets with a penchant for inghimasi-style attacks, where an operative executes his operation until he is killed either by intervention forces or by using a suicide-vest. For instance, Abaaoud and Hame discussed the idea of attacking a place of public gathering, including a rock concert, with an automatic weapon in France, Belgium, or the U.K.46
Even though these plans required fewer resources than the high-profile Verviers plot, the dispatched operatives were not necessarily meant to act alone. Indeed, communications between Ghlam and his Syria-based contacts referred to other “brothers” who were meant to strike simultaneously, even though this never materialized. Hame, for his part, was meant to team up with Abdeljalil Ait el-Kaid, a Spanish resident of Moroccan origin who joined the Islamic State in 2014.
After having been provided with funding for their initial expenses outside Syria, the Islamic State recruits returned to Europe where they continued to receive material assistance from their group. Abaaoud promised Hame that once home, the Islamic State could easily facilitate his access to weapons.47 This claim can be corroborated by the fact that, while in Syria, external operations figures managed to facilitate the purchase of, among other items, weapons, ammunition, and bulletproof vests for Ghlam through their militant contacts in France. Afterward, Ghlam’s handlers pointed him toward a car in a parking garage where he could find them.48
Throughout the attack’s planning, encrypted communications between Ghlam and the external operations personnel often centered on progress reports and operational guidance. Ghlam’s handlers instructed him to attack a crowded church, an operation that would “relieve” the Islamic State from owing to the hardships then facing the group, they told him. Ghlam, for his part, kept his handlers updated on his activities, notifying them about his reconnaissance missions around potential targets. He also sought their approval and tactical advice on how to proceed in the planning and execution of his operation, including on the most trivial details like if they would agree with him wearing a mask during the attack. If he survived the attack, Ghlam also discussed the possibility of a follow-up attack, this time against public transportation.49
Setting in Motion a Terror Campaign in Europe
By the summer of 2015, the Islamic State stepped up its external efforts by directing a large number of operatives, leaving Syria in small groups, to launch a major wave of violence in Western Europe. The opening of the migrants’ “Balkan route,” following the Macedonian decision to allow migrants 72-hour permits to transit through the country,50 offered the group a unique momentum; it could now dispatch its skilled veterans with more ease by using forged Syrian passports, even though they were on European extremist watchlists. As a result, nearly all Paris and Brussels attackers came back to Europe using forged Syrian passports and infiltrated the refugee flow. The only notable exception was Vilus, who was arrested in Turkey in late July 2015 on his way to Western Europe. Sent by Abaaoud to attack France,51 Vilus used a real Swedish passport belonging to another Islamic State member.52 While the organization was castigating Syrians fleeing its self-styled caliphate for Europe, it was cynically capitalizing on the refugee influx to further its global agenda.
A key step facilitating this came in June-July 2015, when Abaaoud entrusted a young Algerian named Bilal C. with mapping out the “Balkan route” by checking border controls and smuggling opportunities. The scouting mission took Bilal C. from Syria to Turkey, Greece, the Republic of Macedonia, Serbia, Hungary, and Austria. During his trip, the Algerian continuously informed Abaaoud on any open border crossings, waiting times, and arrival and departure routes.53 While Abaaoud’s whereabouts during this timeframe long remained murky, new information from European investigations reveal that the Belgian Islamic State operative took the same route to enter Europe, traveling from Syria to Turkey, Greece, the Republic of Macedonia, Serbia, Hungary, Austria, Germany and Belgium.54 His return to Europe, despite being on the radar screen of security agencies, speaks volumes about his determination to have a direct hand in the forthcoming attacks.55
These investigations also unveil that, closely following the footsteps of Bilal C., Abaaoud traveled to Europe with Ayoub el-Khazzani, a Moroccan national who had been in Syria since May and who also received travel reports from Bilal C. While few details have emerged about his trajectory so far, el-Khazzani’s direct links to Abaaoud now establish that he was part of an Islamic State plot. By August 1, 2015, the two were in Hungary. Staying together in a hotel in Budapest, they parted ways on August 4 when Abaaoud left for Austria by car and el-Khazzani left for Vienna by train the day after. In the meantime, Bilal C., who had been briefly detained in Hungary in mid-July, left the refugee camp he was staying in and managed to make his way to Germany.56 Their return to Europe quickly manifested into another plot, with el-Khazzani’s failed assault against a Thalys train on August 21.
During this time, a Belgium-based jihadist network deeply tied to the mother organization in Syria dealt with facilitation and material support for the terrorist campaign to come. According to the Islamic State, brothers Ibrahim and Khalid el-Bakraoui played the most pivotal part in these preparations, stating “it was firstly due to … Ibrahim and his brother that the raid in Paris took place.”57 Indeed, they drew on their contacts in criminal circles to stockpile weapons and participated in accommodating Syria jihadist returnees in Belgium.58 Salah Abdeslam, Mohamed Abrini, Ahmed Dahmani, and a few others also proved helpful in providing logistical support. For example, these three are strongly suspected to have traveled to the Netherlands in August to acquire weapons via their contacts.59 It was also through criminal contacts that Syria returnees such as Laachraoui obtained forged Belgian passports upon their return.60
Newly obtained evidence from the investigations has shed further light on the role in the conspiracy of Abdeslam, a longtime friend of Abaaoud with whom he kept contact after the latter’s departure to Syria, as a key logistical conduit for the Syrian veterans in Europe, playing a critical role in assembling the attack teams.61 Between August and October 2015, Abdeslam made four round trips from Belgium to Central Europe—three to Hungary and one to Germany—to pick up fighters the Islamic State had infiltrated into Europe. He first traveled to Kiskoros, Hungary, on August 30 to pick up Bilal Hadfi and Chakib Akrouh, two Paris attackers, who had arrived in the country five days earlier. On September 9, 2015, Abdeslam made another trip to Budapest where Laachraoui and Mohamed Belkaid, an Algerian with a leading role among the returnees, had been staying since September 3. The last trip to Budapest occurred on September 17 when Abdeslam picked up the three Bataclan attackers—Sami Amimour, Ismaël Omar Mostefaï, and Foued Mohamed-Aggad—who had arrived at a hotel in Budapest a week earlier.
The fourth Abdeslam trip—to Ulm, Germany, on October 2—was to bring three other returnees named Osama Krayem, Sofiane Ayari, and a third known as A. Ahmed, whose forged Syrian and Belgian documents were later recovered in Belgium. A. Ahmed also came to Europe via Hungary where he stayed at the Bicske refugee center. He was later arrested in Hungary before going to Austria and fleeing to Turkey on November 16 and is now believed to be in Syria.62
Two of the Stade de France suicide bombers, Iraqi nationals using passports under the names of Ahmad al-Mohammad and Mohammad al-Mahmood, gained access to Europe through the migrants’ route on October 3, 2015. They entered Europe with at least two other jihadis who were caught before reaching Paris in time for the attacks, the Algerian Adel Haddadi and the Pakistani Muhamad Usman.63
These militants were far from being the only ones dispatched by the organization to Europe. Investigations have revealed that other operatives were also sent to Europe during the fall and winter of 2015. These included Youcef Bouimaiz, an Algerian, and Kamal Agoujil, a Moroccan, who were arrested in the same Salzburg refugee center attended by Usman and Haddadi.64 This refugee camp also hosted three Syrian nationals who, according to the investigators, were also Islamic State operatives and were eventually arrested in Schleswig-Holstein, Germany last September.65 Also, a Moroccan national named Abid Tabaouni, who Haddadi and Usman connected with in Salzburg after he made his way via the refugee route, was arrested in Brussels in July 2016.66
Command and Control Processes
The Paris and Brussels attacks were the outcome of a year of effort by the Islamic State to target Europe. While the organization’s set of targets had long been centered on civilian gatherings, such as places of entertainment and public transportation, the operatives were still allowed to determine the specific timing and targets depending on circumstances on the ground and security concerns. As these attacks reflected, their implementation was not without setbacks. For example, the investigation suggests that the initial plan of Abaaoud and his accomplices was more ambitious than what was carried out, involving attacks in other locations such as the Netherlands67 where Krayem and Ayari are suspected to have planned an operation against Amsterdam’s Schiphol Airport.68
Despite changes in the operational agenda, the broad targeting guidelines set by the Islamic State were followed and some targets had long been contemplated. For instance, even though the Brussels attacks were triggered by the security pressure felt by the operatives after several police raids in Belgium days earlier, the Zaventem airport had been “selected,” according to Belgian court records, as a potential target by the Verviers cell more than a year before the attack on March 22, 2016. In a cell phone used by Abaaoud in Greece, the investigators had recovered several sketches of a man pushing a trolley carrying a bomb with signs indicating “Zaventem” and “arrivals,” and another drawing featuring a taxi.69
Despite their operational flexibility, the Islamic State operatives sent to Europe made sure to maintain communications with their principals in Syria, sending progress reports and being provided with instructions and money transfers.70 These regular contacts illustrated the robust command and control in the group’s external operations planning.
This aspect is further evidenced by the data recovered from a laptop used by the Islamic State members behind the Paris and Brussels attacks. Among the evidence recovered were target lists, audio recordings, and text messages. A folder titled “November 13” contained several files investigators believe detailed the architecture of the plot: “Omar group” (a probable reference to Abaaoud’s kunya), “French group” (a probable reference to the three Bataclan attackers), “Iraqi group” (in reference to the Iraqi suicide bombers who targeted the Stade de France), “Schiphol group” (a likely reference to the Amsterdam airport), and “Metro group” (that could reference the Brussels metro bombing or indicate a future target).71
The laptop highlighted the central role in the Paris and Brussels attack network of a senior Belgian operative based in Raqqa known as “Abu Ahmad,” whose real name is Osama Ahmad Mohammad Atar. He was born in Belgium in 1984, and is a cousin of the Bakraoui brothers. Atar is a jihadist veteran who first traveled to Iraq as early as 2002. After being arrested in Ramadi in 2005, he was convicted by an Iraqi criminal court to life imprisonment in 2007, a sentence later reduced to 10 years. He was subsequently sent to several detention facilities, including Camp Bucca, known to have hosted Islamic State leader Abu Bakr al-Baghdadi. He was freed in 2012 after an intense media campaign and traveled to Syria soon after.72
Audio and text communications exchanged through encrypted messaging applications with the attacks’ bomb maker, Laachraoui, indicate that Abu Ahmad oversaw the plot from Syria and provided guidance on the targets. A plan was discussed for a massive bomb attack. Another was to target France again on the eve of the Euro 2016 soccer championship or to kidnap “one or two heads” to free several jihadis, including Nemmouche, the Brussels Jewish Museum attacker. Laachraoui and one of the Bakraoui brothers also reported to him on the modus operandi and operatives to be involved. Abu Ahmad advised Laachraoui to use explosives rather than guns after the cell lost its AK-47 ammunition following a raid on its safe house in the Forest district of Brussels. He also provided technical guidance on bomb making and received the attackers’ last wills.73 Ultimately, however, the terrorists, needing to act fast before they were arrested, decided the targets and timing on their own.74
The role of Abu Ahmad/Osama Atar as coordinator and handler of returning foreign fighters has been confirmed by the investigation. His Turkish phone number was retrieved on a Stade de France suicide bomber. The same number was found in the cell phone of Adel Haddadi. Haddadi and Usman were in constant contact with Abu Ahmad during their trip to Europe through the encrypted Telegram messaging application, and Abu Ahmad was the one to whom they reported. After his arrest Haddadi told interrogators that Abu Ahmad had been responsible for their military training in Raqqa and that he provided them with false passports, communication devices, contacts with facilitators and smugglers, and money.75 When Haddadi and Usman were unexpectedly detained by the Greek authorities, Abu Ahmad organized the transfer of additional funds to continue their trip.76 So far, he is the only cadre of the Islamic State whose direct involvement in the planning of the Paris and Brussels attacks has been formally established and documented.
Another suspected leading figure in the Paris-Brussels attack network, Abu Suleyman al-Faransi, is considered by U.S. intelligence agencies to be one of the “conceivers” of the attacks. Indeed, he is described by U.S. intelligence as one of those involved in creating the infrastructure of the Islamic State’s external operations unit that ultimately reported to al-Adnani.77
Abu Suleyman has been identified78 as Abdelilah Himich, a 26-year-old Moroccan national who lived in France for 10 years in Lunel—a town with a reputation as a jihadist recruiting ground—before leaving for Syria in February 2014, months after he was released from prison following a conviction for drug trafficking in April 2013.79 After initially joining Jaysh Mohamed Ash Sham, a fighting unit founded by an Egyptian-Afghan veteran close to Jabhat al-Nusra and active in northeast Syria, he joined the Islamic State in April 2014. Despite lacking any longtime ties to jihadist networks, he was quickly promoted by the Islamic State. His rapid rise within the Islamic State could be explained by his military service in the French Foreign Legion for two years, during which he served in Afghanistan. Soon after joining the Islamic State he became the emir of the Tarik Ibn Ziad brigade, a leading fighting brigade made up of 300 European foreign fighters. According to several French jihadis who had traveled and fought under his leadership, he also participated in Islamic State-filmed executions and crucifixions.80
Due to his background and combat experience, Himich is likely to have been considered as a key asset for the Islamic State, although the extent of his role in the conception and planning of the European attacks in still debated within the intelligence community.h
The genesis of the plots and attacks conceived and carried out by the Islamic State targeting Europe have usually involved several planners and organizers, who might vary for each project. In that regard, in the Paris and Brussels attacks, the intense communication and brainstorming activity deployed by the operatives, logisticians, ground coordinators, and their principals in Syria are evidence of a collaborative and team process rather than a single mastermind’s plan.
The Future Threat
Following the Paris and Brussels attacks, the Islamic State’s threat to Europe has been mostly through sympathizers responding to the organization’s calls to hit the West, often encouraged or remotely controlled by its Syria-based core members. Fourteen such attacks have targeted Europe since the beginning of 2016.81 Nonetheless, the Islamic State still has a very real capacity to mount centrally directed attacks against Europe. The organization has long contemplated such operations, and over the past two years, it has been increasingly invested in its external operations deployment and support networks, with a special focus on France and Belgium. The number of veterans from the Syrian battlefields being deployed to Europe and the apparent continued survival of senior francophone figures at the apex of the Islamic State’s external operations wing suggest that despite military efforts to deprive the Islamic State of territorial control in Iraq and Syria, the group will continue to be a threat to France, Belgium, and other European countries for some time to come.
Jean-Charles Brisard is Chairman of the Center for the Analysis of Terrorism (CAT) and the former chief investigator for the 9/11 families’ lawyers. He is the author of Zarqawi, the New Face of al-Qaeda. Follow @JcBrisard
Kévin Jackson is Research Director at the Center for the Analysis of Terrorism (CAT) and contributor at the Jihadica academic blog. Follow @alleyesonjihad
Substantive Notes
[a] As of September 2016, 1,112 French nationals or residents and 537 Belgian nationals or residents have traveled to Syria and Iraq. The Belgian numbers include both French-speaking and non-French-speaking. “European Jihad Watch,” Center for the Analysis of Terrorism (CAT), October 2016.
[b] The Cannes-Torcy network grew from ties formed between militants in Cannes and others in Torcy (in the Paris region) around its charismatic leader Jérémie Louis-Sidney, a former drug dealer. Its members participated in an attack against a Jewish grocery in September 2012 and were involved in subsequent plots against military targets. Some network members relocated to Syria.
[c] During his detention, Nemmouche talked about the “Cannes brothers” to a fellow inmate, referring to those from the Cannes-Torcy network who had traveled to Syria. There, Riahi and Nemmouche were both part of KAM, and given that Riahi remained very close to his childhood friends Boudina and Tliba, it is highly likely that Nemmouche also spent time with the latter. See Matthieu Suc, “Mehdi Nemmouche, le djihadiste qui parlait trop,” Mediapart, September 7, 2016.
[d] During a conversation with the fellow inmate, Nemmouche told him that after his return from Syria, he had felt that “everybody had let him down” and that he had ended up roofless with virtually no financial resources. See Suc, “Mehdi Nemmouche, le djihadiste qui parlait trop.”
[e] To get the green light to deploy overseas, Donath claimed he first went to Reda Seyam, a senior German-Egyptian Islamic State member who was the deputy to the Islamic State “governor” of Aleppo. He, in turn, told Donath to first obtain clearance from his supervisor within the amniyat. With that clearance, he went back to Seyam, who said he would recommend this course of action to his own superior. According to Donath, his request was a ruse to allow him to leave the territory of the Islamic State. Authors’ interview, source close to Donath’s case, October 2016.
[f] This network made of French, Saudis, and Levantine jihadis was dismantled from June 2014 onward. It planned to strike a wide range of targets, including hotels. For more background on this network, see Rukmini Callimachi, “How ISIS Built the Machinery of Terror Under Europe’s Gaze,” New York Times, March 29, 2016.
[g] It is not clear whether this was Abdelhamid Abaaoud.
[h] According to French external intelligence, “Abaaoud was a coordinator but not the mastermind. We know the mastermind, but [we] will remain discrete on this issue.” In July, its director was heard by a judge in charge of the investigation on the Paris attacks and stated that he “cannot provide the names of the mastermind and his collaborators due to the sensitivity of [the DGSE] sources.” Thibault Raisse, “Enquête sur le 13 Novembre: le patron de la DGSE interrogé par un juge antiterroriste,” Le Parisien, October 29, 2016.
Citations
[1] Thomas Hegghammer and Peter Nesser, “Jihadi attacks and alleged attack plots in the West, January 2011-June 2015,” appendix to “Assessing Islamic State’s Commitment to Attacking the West,” Perspectives on Terrorism, 2015.
[2] Abu Muhammad al-Adnani, “Indeed Your Lord Is Ever Watchful,” pietervanostaeyen.wordpress.com, September 22, 2014.
[3] For more information on Majlis al-Shura al-Mujahidin and KAM, see Ben Taub, “Journey to Jihad,” New Yorker, May 25, 2015.
[4] For a comprehensive profile of Elouassaki, see Guy Van Vlierden, “Profiles of Three Major Belgian Fighters in Syria and Their Paths to Jihad,” Militant Leadership Monitor, VI:7, July 2015; for more information on Maaroufi, see “Syrie: un jihadiste franco-marocain des Pyrénées-Atlantiques tué,” Le Parisien, June 2, 2014.
[5] Posts on various social media accounts run by Syria-based Belgian and French jihadis, archived by the authors.
[6] Authors’ interview, source close to a case involving a French militant network linked to the Syrian jihad, June 2016.
[7] Facebook post issued by Tyler Vilus on August 2013, archived by the authors.
[8] For more background on the Cannes-Torcy network, see Pierre Alonso, “Cellule de Cannes-Torcy: le terrorisme, affaire de potes,” Libération, December 16, 2015.
[9] Ibid.; authors’ interview, source close to the investigation, May 2016.
[10] “Plusieurs projets d’attentats terroristes déjoués en France, selon une note de la DGSI,” RTL, November 3, 2014.
[11] Authors’ interview, source close to the Lunel network case, June 2016.
[12] Paul Cruickshank, “The inside story of the Paris and Brussels attacks,” CNN, March 30, 2016; authors’ interview, source close to the investigation, May 2016.
[13] Mark Eeckhaut, “Nemmouche zei dat hij werk zocht in Brussel,” De Standaard, July 25, 2014.
[14] “Threat of attack on the Netherlands remains realistic,” National Coordinator for Security and Counterterrorism, Netherlands, July 11, 2016.
[15] Authors’ interview, source close to a case involving a French militant network linked to the Syrian jihad, June 2016.
[16] Paul Cruickshank and Brian Dodwell, “A View from the CT Foxhole: An Interview with John Brennan, Director, CIA,” CTC Sentinel 9:9 (2016).
[17] Abu Muhammad al-Adnani, “Indeed Your Lord Is Ever Watchful.”
[18] “Interview with Abu Umar al-Baljiki,” Dabiq, issue 7, pp. 72-75.
[19] Judgment of the Verviers cell, Court of First Instance of Brussels, July 5, 2016.
[20] Ibid.; authors’ interview, source close to the case, August 2016.
[21] Authors’ interview, source close to a case involving a French militant network linked to the Syrian jihad, June 2016.
[22] Judgment of the Verviers cell, Court of First Instance of Brussels, July 5, 2016.
[23] Paul Cruickshank, Nic Robertson, Tim Lister, and Jomanah Karadsheh, “ISIS comes to Libya,” CNN, November 18, 2014; Geoff Porter, “How Realistic Is Libya as an Islamic State Fallback,” CTC Sentinel 9:3 (2016).
[24] Abu Muhammad al-Adnani, “Say, ‘die in your rage,’” pietervanostaeyen.wordpress.com, January 26, 2015.
[25] Authors’ interview, source close to the Harry Sarfo case, July 2016.
[26] Soren Seelow, “Est-ce que tu serais prêt à tirer dans la foule?” Le Monde, January 6, 2016.
[27] Authors’ interview, source close to the Harry Sarfo case, July 2016.
[28] Rukmini Callimachi, “How a Secret Branch of ISIS Built a Global Network of Killers,” New York Times, August 3, 2016.
[29] Authors’ interview, source close to the Nils Donath case, October 2016.
[30] Callimachi, “How a Secret Branch of ISIS Built a Global Network of Killers.”
[31] Pieter Van Ostaeyen, “Official communications by the Islamic State on the Brussels attacks,” pietervanostaeyen.wordpress.com, March 25, 2016.
[32] Matthieu Suc, “Ces terroristes qui menacent la France 2/3: la chaîne de commandement qui conduit aux attentats,” Mediapart, March 23, 2016.
[33] Ibid.
[34] Ibid.; Soren Seelow, “Le djihadiste français Salim Benghalem aurait été le geolier des ex-otages en Syrie,” Le Monde, September 25, 2015; Éric Pelletier and Thibault Raisse, “Le kamikaze de Bruxelles jouait les kapos en Syrie,” Le Parisien, March 22, 2016.
[35] Authors’ interview, source close to the Vilus case, July 2016.
[36] Callimachi, “How ISIS Built the Machinery of Terror Under Europe’s Gaze.”
[37] Suc, “Ces terroristes qui menacent la France 2/3: la chaîne de commandement qui conduit aux attentats.”
[38] Soren Seelow, “Le djihadiste ‘repenti’ de Paris qui a permis de déjouer un attentat en Allemagne,” Le Monde, June 2, 2016.
[39] Callimachi, “How a Secret Branch of ISIS Built a Global Network of Killers.”
[40] Authors’ interview, source close to the Harry Sarfo case, July 2016.
[41] Suc, “Ces terroristes qui menacent la France 2/3: la chaîne de commandement qui conduit aux attentats;” authors’ interview, source close to the investigation, September 2016.
[42] Seelow, “Est-ce que tu serais prêt à tirer dans la foule?”
[43] Paul Cruickshank, reporting on CNN Newsroom, November 19, 2015.
[44] Authors’ interview, source close to the investigation, September 2016.
[45] Ibid.; authors’ interview, source close to the case, August 2016.
[46] Seelow, “Est-ce que tu serais prêt à tirer dans la foule?”
[47] Authors’ interview, source close to the case, August 2016.
[48] Suc, “Ces terroristes qui menacent la France 2/3: la chaîne de commandement qui conduit aux attentats;” Soren Seelow, “Attentat manqué de Villejuif: sur la piste des commanditaires,” Le Monde, August 3, 2015.
[49] Ibid.; authors’ interview with a source close to the investigation, September 2016.
[50] “Macedonia: Immigrants Gain Safe Passage with Amended Asylum Law,” Independent (Macedonia), June 18, 2015.
[51] French National Assembly investigative committee report on the measures taken by the government to fight against terrorism since January 7, 2015; page 143; July 5, 2016.
[52] Sebastian Rotella, “ISIS via WhatsApp: ‘Blow Yourself Up, O Lion,’” Propublica, July 11, 2016.
[53] Statement of the German Federal Prosecution Office 33/2016, July 7, 2016.
[54] “Macedonia: Immigrants Gain Safe Passage with Amended Asylum Law,” Independent (Macedonia), June 18, 2015.
[55] Jean-Charles Brisard, “The Paris Attacks and the Evolving Islamic State Threat to France,” CTC Sentinel 8:11 (2015).
[56] Information obtained by the authors from the Hungarian Counter-Terrorism Center (TEK).
[57] “The Knights of Shahadah in Belgium,” Dabiq, issue 14, p. 6.
[58] Fabrice Grosfilley and Patrick Michalle, “Quand la police descend chez El Bakraoui trois semaines avant les attentats,” RTBF, June 1, 2016.
[59] Sebastian Rotella, “How Europe Left Itself Open to Terrorism,” Propublica, October 18, 2016.
[60] Authors’ interview, source close to the investigation, September 2016.
[61] Authors’ interview, French and Belgian counterterrorism officials, July 2016.
[62] Information obtained by the authors from the TEK.
[63] Soren Seelow, “Attentats du 13 novembre: Les confessions du quatrième commando,” Le Monde, April 26, 2016.
[64] Boris Thiolay, “Attentats de Paris: révélations sur les trois Syriens arrêtés en Allemagne,” L’Express, September 16, 2016.
[65] Authors’ interview, source close to the investigation, September 2016.
[66] Scott Bronstein, Nicole Gaouette, Laura Koran, and Clarissa Ward, “ISIS planned for more operatives, targets during Paris attacks,” CNN, September 5, 2016.
[67] “ISIS planned for more operatives, targets during Paris attacks,” CNN, September 5, 2016.
[68] Elise Vincent, “13-Novembre: l’enquête dévoile un projet terroriste de grande ampleur,” Le Monde, October 5, 2016.
[69] Judgment of the Verviers cell, Court of First Instance of Brussels, July 5, 2016.
[70] Information obtained by the authors from the TEK.
[71] Vincent, “13-Novembre: l’enquête dévoile un projet terroriste de grande ampleur.”
[72] Soren Seelow, “Oussama Atar, coordinateur présumé des attentats de Paris et Bruxelles,” Le Monde, November 8, 2016.
[73] Elise Vincent, “Le mystérieux ‘Abu Ahmed’, ‘émir suppose’ des commandos de Paris et Bruxelles en Syrie,” Le Monde, October 5, 2016.
[74] Rotella, “ISIS via WhatsApp: ‘Blow Yourself Up, O Lion.’”
[75] Authors’ interview, French counterterrorism officials, June 2016.
[76] For an overview of the external funding of the Paris attacks, see “Le financement des attentats de Paris,” Center for the Analysis of Terrorism, October 2016.
[77] Sebastian Rotella, “U.S. identifies key player in ISIS attacks on Europe,” PBS Frontline, October 19, 2016.
[78] Ibid.
[79] Judgment of the Paris High Court, April 19, 2013.
[80] Authors’ interview, French intelligence officers, November 2016.
[81] German federal domestic intelligence (Verfassungsschutz) director Hans-Georg Maaßen in conversation with Rolf Clement, Verfassungsschutz, October 30, 2016.
