Abstract: In November 2016, French authorities arrested seven men in Strasbourg and Marseille on suspicion of planning a terrorist attack in the Paris region. During the following months, a total of 14 people were arrested in five different countries in relation to the plot. The arrests were the result of a large-scale investigation that saw cooperation between Portugal, Spain, France, Germany, and Morocco. Information obtained by the author from judicial documents and interviews with intelligence and security officials sheds new light on how this network spread throughout Europe; how it was linked in various ways to the Islamic State network behind the November 2015 Paris and March 2016 Brussels attacks; how the network financed itself through credit card fraud; and how it used encrypted communication apps to receive instructions from Syria. Behind it all were two men who entered Europe through Portugal posing as political refugees. With Portugal previously being used as an operational base for the Basque terrorist group ETA, the case raises concerns that countries in which security services are less geared up to confront jihadi terrorism are being used as logistical hubs by Islamic State networks.
On November 21, 2016, French Interior Minister Bernard Cazeneuve announced that a large-scale terrorist attack in the Paris area had been foiled following the arrest of seven men on the night of November 19-20 in the cities of Strasbourg and Marseille.1 Five were kept in custody: Yassine Bousseria, Hicham Makran, Sami Ben Zarroug, and Zacaria M’Hamedi, all French nationals, were detained in Strasbourg, and Hicham el-Hanafi,2 a Moroccan with a resident permit issued in Portugal that had been previously flagged3 by a partner country, was detained in Marseille.
Initially, public attention was focused on the group of four detained in Strasbourg. According to information provided by Paris prosecutor François Molins, two of them had traveled to the border region between Turkey and Syria, and following their return to France, they received instructions through encrypted communication devices from Syria. “The Strasbourg cell had instructions to get weapons, given by a commander in the Iraq-Syria zone,” Mr. Molins said.4 During searches of their apartments, authorities found guns and a 12-page notebook with manuscript references to jihad and the Islamic State leader Abu Bakr al-Baghdadi.5 French police believed they had uncovered a sleeper cell waiting for orders.6
During the following months, however, judicial and intelligence cooperation between several European countries led investigators to revise their thinking. They came to believe that the most important suspect was the man detained in Marseille, Hicham el-Hanafi. Their detailed analysis of his activities, travels, contacts, and finances revealed what seemed to be an undercover network of Islamic State operatives that spread throughout Europe and was financed through a credit-card fraud scheme.7
El-Hanafi, they concluded, had direct contact with previously identified members of the Islamic State’s external operations department as well as links to the network responsible for the November 2015 terrorist attacks in Paris.8 Two years later, he is still awaiting trial.
This article is the result of months of joint investigative reporting by a group of journalists from four European countriesa and is based on thousands of pages of judicial documents, investigative files, interviews with key witnesses, and several counterterrorism and intelligence officials. It reveals how European cooperation led to the dismantling of a network that was preparing an attack in France, and examines the loose ends that are still under investigation, including the alleged role of Abdesselam Tazi, a mysterious man currently held in Portugal.
Entry to Europe
Hicham el-Hanafi was born in Fez, Morocco, on July 16, 1990.9 Up until his early 20s, he showed no signs of radicalization nor was he particularly religious: he drank with friends, smoked, had girlfriends, and worked as a chef in a Turkish restaurant.10 According to his family, he started to change in 2013 when he met Abdesselam Tazi, a then 59-year-old former policeman.11 They bonded and together left Morocco on September 8, 2013.
El-Hanafi’s brother Amine recalls meeting Tazi as the duo was about to depart. “It was the first time I saw him. He told me not to worry because he would take care of my brother the best way possible,” Amine told the author.12 Tazi and el-Hanafi took a bus to Agadir and then proceeded to Mauritania, Senegal, and finally Guinea-Bissau. There, on September 23, 2013, they boarded a TAP flight to Portugal using forged documents.13 El-Hanafi carried a Romanian residence permit under his own name while Tazi had a French passport under the name of Pascal Fernand Joseph Dufour.14
Questioned by the border patrol agents at Lisbon airport, each of them immediately asked for asylum, saying they had been persecuted in Morocco for their political views and activities in support of the February 20 movement,15 b which was calling for democratic reforms. According to authorities, the two never mentioned that they knew each other.
For a week, they stayed at temporary facilities at the Lisbon airport. They were then sent to the Refugees Housing Center at Bobadela, on the outskirts of Lisbon. In late November 2013, they were dispatched to a social security installation in the district of Aveiro in northern Portugal and received provisional resident permits that allowed them to travel freely. Their permanent residence authorization was issued in September 2014, valid until October 2019.16
For months, they managed to keep themselves under the radar. They rented a room in Aveiro17 and traveled freely to several European countries, mostly Spain, France, and Germany.18 They also seemed to have financial resources not compatible with their refugee status, as a part of which they received a small monthly allowance of 150 euro.19
It was only in early 2015 that their activities came to the attention of Portuguese authorities, following a complaint submitted by Hicham el-Hanafi’s brother, Amine.20 The two had not seen each other for almost two years. But when he moved to Lisbon, Amine immediately realized that his younger brother had changed: Hicham was strictly following what he saw to be his religious duties; he refused to greet his female cousin because she was not properly dressed, and every conversation would inevitably end in a discussion about jihad and the war in Syria.21 Amine’s suspicions quickly became certainties. First, there was a long conversation he took part in with other Moroccans at Porto airport in which Hicham el-Hanafi and Abdesselam Tazi made clear that they believed that every Muslim had an obligation to perform jihad. Second, Hicham revealed to Amine that he had spent two months in Syria receiving “military training from Islamic State affiliated groups” in late 2014.22 “I tried to persuade him, but it was too late,” Amine told the author.23 But it was only when Amine became aware that Hicham had managed to convince their mother and four younger sisters to travel to Syria that he decided to contact Portuguese authorities.24 Amine also testified that Abdesselam Tazi was responsible for his brother’s radicalization and that both had managed to convince at least two other Moroccan refugees in Portugal to join the Islamic State in Syria.25
On July 30, 2015, Portuguese Judiciary Police opened an official investigation into the activities of Hicham el-Hanafi and Tazi for suspicion of terrorism.c The investigators quickly realized that both men had been spending most of their time outside Portugal, and authorities issued a request for discreet surveillance under the Schengen Information System.26 Nothing came up to indicate their whereabouts for three months. Then in October 2015, the pair popped up in the city of Wuppertal, Germany, when they used their bank cards to withdraw the 150 euro they received that month from Portuguese social services.
In the following months, their presence was detected in several European towns and cities: Paris, Amsterdam, Hamburg, Frankfurt, Bremen, Dusseldorf, Hagen, Brussels, Manchester (where they were prevented from entering the United Kingdom at Manchester airport due to the use of false documents and were sent back to Germanyd), Istanbul, Athens, and Tirana. They also made a mysterious journey to South America where Tazi visited Brazil, Nicaragua, Guatemala, Panama, Honduras, and El Salvador.27
Each time they returned to Portugal, Tazi and el-Hanafi were the subject of close surveillance by teams of the Unidade Nacional de Contra Terrorismo of the Judiciary Police and also from Serviço de Informações de Segurança (SIS), Portugal’s domestic intelligence agency. When back in Portugal, the two men frequented the northern region, where they spent thousands of euro on mobile phones, clothes, and shoes, and had medical treatments they paid for with forged credit cards.28 According to Portuguese authorities, the two used the money obtained from the sales of those goods to finance the successful travel of two Moroccan nationals who had obtained asylum in Portugal—Abderrahmane Bazouz and Abdessamad Anbaoui—to Syria, where they joined the Islamic State.29
International cooperation also started to produce results. In early 2016, Belgian authorities informed the Portuguese police that in April 2015, Tazi had received two wire transfers: one for 3,295 euro was sent by a certain Chakhir Haddouchi and another for 1,445 euro was sent by a man named Salaheddine Lechkar.30 Haddouchi’s address in Brussels was the same as that of two Belgians included in the list compiled by Belgian authorities of jihadis who traveled to Syria: Aberkan Abdelhouaid and Aberkan Abdessamad.31 According to information provided to the author by intelligence and counterterrorism officials,32 Chakhir Haddouchi is the brother of Anouar Haddouchi,33 a Belgian jihadi whose bank account in the United Kingdom was the source of 3,000 British pounds withdrawn between May and June 2015 and handed in July 2015 to Mohamed Abrini34—the so-called “man in the hat” in the March 2016 Brussels airport bombing who has been charged for his role in the Islamic State cell behind that attack and the November 2015 Paris attacks.35 Salaheddine Lechkar, for his part, is considered a person of interest by European authorities because of his possible connections to an Islamic State financial middleman based in Turkey.36 Lechkar’s current whereabouts are unknown to authorities.37
An Undercover Operation in France
In the summer of 2016, the Portuguese investigation came to a halt. For months, there had been no sign of Tazi and el-Hanafi. Due to a lack of communication among European Union member states, the Portuguese did not learn until November 2016 that in June 2016 Tazi and el-Hanafi had been detained in Germany for credit card fraud.38 This was despite the existence of an alert regarding both men in the Schengen Information System. After being arrested in Germany, Tazi remained in custody due to prior felonies related to false documentse while el-Hanafi was released two days after their arrest. He then traveled to Italy, Spain, and later to France.39
According to French judicial documents, on November 14, 2016, the Direction Génerale de la Sécurité Interieure (DGSI) received a warning that two residents of Strasbourg—Yassine Bousseria and Hicham Markan—were hatching an imminent attack.40 The documents do not mention who provided the warning to the DGSI, but according to European intelligence officials, the alert came from Israeli intelligence and stated that the cell was under direct instructions from high-profile Islamic State members in Syria.41
These same French judicial documents mention that on November 17, 2016, another preliminary inquiry was opened in France regarding an imminent attack in the south of France.42 That information was shared by the DGSI, which received it from an infiltrated source who himself was receiving instructions from a high-profile member of the Islamic State in Syria “through the encrypted communications app Threema.”43 That confidential source shared print screens of his conversations with the Islamic State fighter who, on November 15, 2016, instructed him to “retrieve 4000 euro” to finance the purchase of two Kalashnikovs.44 Two days later, the organizer in Syria instructed him to house an Islamic State operative for one evening in Marseille.45 On November 20, 2016, Hicham el-Hanafi was arrested when he “presented himself at the meeting point. He was in possession of 4.281 euro.”46
What also ultimately contributed to the French understanding of the terrorist conspiracy was a trap set months before by French investigators.47 According to French judicial documents regarding the investigation of the Strasbourg and Marseille plots, between March and July 2016, an undercover operation was conducted under the instructions of the Paris Prosecutor during which at a certain point a box with four Kalashnikov machine guns and several magazines with ammunitions were buried in the forest of Montmorency, in the northern region of Paris.48 As part of the sting operation, the GPS coordinates of this cache were provided to a member of the Islamic State in the Iraqi-Syrian zone who was looking for weapons that could be used by one or more would-be attackers in France.49 The police put the box under heavy surveillance for months in the hope someone would take the bait. But the conspirators were arrested before they could retrieve the arms cache.50
According to the French judicial documents, after the arrest of Yassine Bousseria and Hicham Makran in Strasbourg in November 2016, French authorities were able to establish that not only had both men been in contact with Islamic State members in Syria/Iraq since 2013, but also that the attack sponsor in Syria/Iraq had supplied them with the GPS coordinates of the Kalashnikovs hidden in Montmorency.51
Hicham el-Hanafi’s arrest—simultaneously with the arrest of four suspects in Strasbourg—ignited a joint European effort between intelligence and security services. A few days later, a DGSI team traveled to Portugal to assist the Judiciary Police during the searches conducted of the apartment that el-Hanafi and Tazi maintained in Aveiro.52 Simultaneously, French forensic teams began an analysis of el-Hanafi’s mobile phone, which allowed them to track his movements in the weeks prior to his arrest and to identify several key contacts in France, Spain, and Germany.53 They also managed to establish how he obtained the 4,281 euro found in his possession. More importantly, they identified his contact in Syria: Walid Hamam,54 a close associate of Boubaker el-Hakim,55 a senior French-Tunisian Islamic State external attack planner whose subordinatesf helped facilitate the November 2015 Paris attacks.56
Born in Gonesse in the northeastern suburbs of Paris in 1984, Walid Hamam traveled to participate in jihad in Syria in December 2013.57 He became part of Katibat al-Muhajirin, a magnet for francophone volunteers to the Syrian jihad and whose members were involved in several plots in Europe.58 One year later, posing as a Syrian refugee, he went to Athens where he stayed in the same apartment that was previously occupied by Abdelhamid Abaaoud,59 the November 2015 Paris attacks ringleader. Back then, “Turkey and Greece were used as major facilitation and command hubs” for attacks but also as “gateways to return from Syria.”60 The Belgian investigation into a terrorist conspiracy coordinated by Abaaoud thwarted by a gun battle in the eastern Belgian town of Verviers in January 2015 showed that Hamam was supposed to be one of the Islamic State attackers in the operation they were planning.61 For that, he was sentenced in absentia to five years in prison.62 From 2015, he was considered a key online recruiter for the Islamic State, focusing mostly on recruiting extremists from the French town of Trappes.63 He was killed by a drone strike in Raqqa on December 4, 2016.64
According to judicial documents, in October 2016, Walid Hamam contacted from Syria a former neighbor in Trappes, Mohamed Amraoui, via the Telegram messaging app and asked him to obtain 4,100 euro: 2,000 from Amraoui’s own personal savings; 1,000 that would be given by Hamam’s mother; and another 1,100 from Abou Sy, an old friend of Walid Hamam.65 Hamam instructed Amraoui to then deliver an envelope with the money to someone who was supposed to call him.66 Amraoui collected the money, but when he received a call from a German mobile number, he got scared, decided he wanted out, and gave all the money to Abou Sy.67
Under the instructions of Walid Hamam, Abou Sy delivered the envelope to a man that he described to the police officers who later questioned him as being from North Africa, 1.80 meters tall, and barely able to speak French, according to the judicial documents. Abou Sy met the man twice: on November 17 and 18, 2016, in Trappes.68
Abou Sy, according to the documents, identified him as none other than Hicham el-Hanafi.69
The forensic analysis of el-Hanafi’s mobile phone also allowed French investigators to establish that four days before collecting the money, he was very close to “the cache of weapons [hidden in] Montmorency, whose GPS coordinates he knew, without visibly succeeding”70 in finding it. In the following days, between November 14 and 17, 2016, he went to Trappes where he got “the money to buy the guns in Marseille.”71 Questioned by French authorities, el-Hanafi denied all accusations.72
Arrests in Spain and Morocco
With the arrest of Hicham el-Hanafi, European counterterrorism agencies significantly intensified their information exchange. Portuguese Judiciary Police reminded their Spanish counterparts that el-Hanafi and Tazi had traveled to San Sebastian in the summer of 2014 and 2015, that in August 2016, after Tazi’s arrest in Germany, el-Hanafi took a flight from Italy to Barcelona.73 They also mentioned that on October 19, 2016, el-Hanafi was identified in Guipúzcoa by two police officers as being in the company of Yahya Nouri,74 a Moroccan who entered Spain illegally when he was a child and who took part in a program designed to help disadvantaged youth through boxing.75 Following instructions from el-Hanafi, Nouri took a flight to Turkey a few days after their October 19, 2016, meeting.76
The reasons for this travel would only be known in late November 2016, when at the request of Spanish and French authorities, Yahya Nouri was arrested upon his return to Morocco from Turkey and remains in custody.77 On November 29, 2016, Nouri was questioned by the local police and confessed to having met the “Salafist-jihadist” Hicham el-Hanafi for the first time in July that year.78 According to his testimony, the two first spoke in the company of a common friend and later alone, mostly about jihadism, because they “shared the same convictions adopted by ISIS.”79 They watched propaganda videos together on el-Hanafi’s personal computer.80 While they were in a vehicle together during one of those meetings, they were approached by Spanish police and questioned for three hours before being released. After that, according to Nouri’s testimony, el-Hanafi told him that he was under surveillance in Portugal because he “had two Moroccan friends that had immigrated to Syria”—one of them was named “Abou Ahmed al-Andaloussi” and was based in Homs; the second, Abderrahmane, had been killed in the same region.81
Around October 2016, at a time when their relationship had been “consolidated,” Nouri said el-Hanafi proposed to him that he take part in a plan that was being put in place to attack Paris. “I accepted his proposal without hesitation,” he later told Moroccan police.82 “Hanafi told me that the ISIS leaders attributed great importance to the French capital and tried by all means to attack it … [because] it’s considered a symbol of secularism, corruption and depravation of morals, under the cover of individual freedom and human rights.”83 For that attack, according to Nouri, he (Nouri) and el-Hanafi would have Kalashnikov machine guns at their disposal.84
In his testimony, Nouri explained that in October 2016 Hanafi ordered him to travel to Turkey. The plan was to cross into Syria in order to meet a Moroccan Islamic State operative called Abou Ahmed al-Andaloussi, receive military training, and then return to France trough Germany.85 Nouri boarded a plane in Bilbao to Ankara on October 19.86 Upon his arrival in Turkey, Nouri bought a SIM card to maintain contact with his mentor through Telegram, the encrypted communications app, and also via Facebook under false aliases.87 During his time in Turkey, Nouri received a total of 255 euro sent by el-Hanafi and another 133 euro from a friend named Mehdi Kacem.88
Following el-Hanafi’s instructions, on November 11, 2016, Nouri went to the Turkish town of Gaziantep near the Syrian border. On his second day there, Nouri, according to what he told Moroccan authorities, received a message through Telegram from someone who claimed to be a Saudi Islamic State fighter acting on behalf of the aforementioned al-Andaloussi.89 Because entering Syria would be “difficult,” the Saudi said, someone would meet him in Gaziantep.90 Later that day, al-Andaloussi himself explained to Nouri the new plan over Telegram: an envoy of his would give Nouri a memory card and Nouri’s mission would be to deliver it to Hicham el-Hanafi.91
That handover took place on November 18, 2016, during a meeting that lasted about four hours.92 It started with al-Andaloussi’s Syrian envoy demanding that Nouri swear allegiance to Abu Bakr al-Baghdadi, which he did. In the end, the fighter gave Nouri the memory card and told him to wait until they were able to provide a false passport and the necessary money for the journey back to Europe.93 Later, al-Andaloussi transmitted to Nouri some security measures to adopt and advised him not to look into the memory’s card content.94
The next morning, Nouri, according to his own later account, received a message from el-Hanafi, congratulating him for his success.95 It was the last time both men talked. On November 20, 2016, Nouri received a message on Telegram in which the Syrian fighter he met told him about el-Hanafi’s arrest in France.96 The fighter also advised him to be careful and to get rid of the memory card. Later, Nouri received similar instructions from al-Andaloussi.97
According to his testimony, the next morning Nouri did the opposite and opened the memory card through his mobile phone. He told the Moroccan police that inside the memory card there were two folders. One had a speech of Abu Bakr al-Baghdadi and a picture of their target in Paris—a specific café also identified by its GPS coordinates.98 The second folder had three French phone numbers. After seeing the memory card content, Nouri threw it in the sewer at the Gaziantep train station, from where he took a train to Istanbul.99 From Istanbul, he returned to Morocco where he was detained.
Around the same time in late November 2016, Moroccan police detained Mehdi Regragui, a firefighter working for the Civil Protection in Fez who had a close relationship with el-Hanafi.100 In his interrogation, Regragui confirmed he was aware that el-Hanafi had joined the Islamic State and that in 2014, el-Hanafi had been in Syria. He also told investigators that el-Hanafi sent him mobile phones and other devices that el-Hanafi bought in Europe through credit card fraud for him to sell them in Morocco. He would keep a percentage for himself and return the remaining money to el-Hanafi.
Two months after the arrests in Marseille and Strasbourg, the National Police in Spain initiated Operation Haram. On January 17, 2017, Spanish authorities arrested Medhi Kacem, 26, a Moroccan boxer linked to el-Hanafi and Nouri. Though Kacem publicly presented himself as an example of integration through sport,101 according to Spanish judicial documents, he was suspected of leading an underground cell that recruited disadvantaged young people to the Islamic State.102
Investigation in Germany, Prosecution in Portugal
Meanwhile in The Hague, judicial authorities from France, Portugal, and Germany (Morocco declined an invitation to join) gathered at Eurojust headquarters on January 17, 2017.103 The exchange of information between the three countries led investigators to conclude that the credit card frauds committed by el-Hanafi and Tazi were related to terrorism financing. Accordingly, a new investigation was opened in Germany,104 where both men had been arrested before without raising terrorism suspicions.
The investigations that followed revealed that during their time in Germany, both men had used more than 47 false identities and had obtained more than 73,000 euro through credit card fraud.105
On December 12, 2016, Tazi was sentenced by the district court of Dusseldorf to one and a half years in prison for fraud. The sentence was suspended on probation. But the LKA (State Criminal Police) arrested him again in the courtroom on the basis of a European arrest warrant issued by both Portugal and France.106 Believing that Tazi had more chances of being prosecuted in Portugal, both countries agreed that he should be sent to Lisbon,107 where he arrived in March 2017.
One year later, Tazi was charged in Portugal for eight crimes related to terrorism.108 According to the Public Prosecutor, he was responsible for the radicalization of Hicham el-Hanafi and had, through the use of false credit cards, obtained thousands of euro that he used to finance terrorism-related activities.109 While in prison awaiting prosecution and a possible trial, Tazi denied any connection to terrorism and claimed to be the victim of a revenge organized by other Moroccans living in Portugal.110 Tazi admitted to all of the credit card fraud, but argued that it was his only way of surviving because he was not able to get a job.111 He never justified his connections to—or money transfers received from—known jihadis.112
Tazi’s Portuguese lawyer contested all terrorism charges in the pre-trial judicial phase of the case (“instrução”) that took place in July 2018. The judge in charge of the case dismissed all terrorism-related crimes, ruling that there was not enough evidence to send him to trial on that basis.113 But the judge made clear that he did not take into account the documents, interrogations, and evidence sent to Portugal by the French, German, Spanish, and Moroccan authorities. He considered that the Public Prosecutor had not complied with the legal proceedings necessary for the documents to be legally accepted.114 The Public Prosecutor appealed that decision to a higher court, which has not yet ruled. For now, the 64-year-old Moroccan is under trial for credit card fraud.115 His lawyer, Lopes Guerreiro, believes he might be released soon, unless the Judiciary Police arrests him again on the basis of the European arrest warrant that was issued by France in late 2016.116
In total, 14 people were arrested in five different countries and the case is not close to an end. Hicham el-Hanafi remains in custody and under investigation, and of the group arrested in Strasbourg, only Yassine Bousseria and Hicham Makran remain in prison due to terrorism charges, while Zacaria M’Hamedi, Sami Ben Zarroug, and Hamdi Brini were convicted for illegal arms possession.117 In Spain, Medhi Kacem is still subject to investigation,118 and in Germany, there is an ongoing investigation on terrorism financing focused on the activities of Hicham el-Hanafi and Abdesselam Tazi.119
Takeaways
The case of Hicham el-Hanafi and Abdesselam Tazi highlights the danger posed by jihadi extremists manipulating European asylum laws to enter Europe posing as political refugees. The duo used European Union freedom of movement to create a recruitment network based on personal connections that spread throughout at least five different countries.They helped weave and were part of a complex spiderweb of terrorist connections. The Strasbourg-Marseille network was truly transnational with nodes across Europe connected to Islamic State attack planners in Syria and others involved in previous terrorist conspiracies targeting European countries. From Portugal, Hicham el-Hanafi and Abdesselam Tazi were able to travel freely—mentioning to their known acquaintances that they were looking for business opportunities or simply doing tourism in Spain, France, and Germany. Because authorities did not know about their alleged connections to terrorism, they were able to keep themselves under the radar, even though they were eventually identified for document fraud.
The case highlights the key role played by document fraud in jihadi networks in Europe. According to the allegations, document fraud played a key role in el-Hanafi and Tazi’s terrorist enterprises. False identities helped both men to enter Europe and allowed them to obtain tens of thousands of euro through credit card fraud, which authorities believe was used to finance terrorism-related activities.
Encrypted communication apps like Telegram were important to their network, allegedly allowing Islamic State operatives to transmit instructions to their associates in Europe on how they should proceed to obtain the necessary resources to commit terrorist attacks. The thwarted attack was yet another case of terror by remote control from Syria/Iraq. As in other terrorist conspiracies against the West in recent years,120 Islamic State operatives were allegedly pulling the strings from overseas, including target selection.
The case also highlights the importance of cooperation between European agencies given the transnational nature of the threat. What helped unravel the Strasbourg-Marseille network was an exchange of information between European countries. The case was one of the first to benefit from a cooperation platform created in late 2016 in The Hague to share terrorism-related information among European Union intelligence services.121 According to the head of Portuguese domestic intelligence, in 2017 alone this platform was instrumental in helping European Union authorities foil 12 terrorist attacks and arrest 30 terrorism suspects.122
Finally, the case raises concern that European countries like Portugal and Greece123 in which security services are less geared up to confront jihadi terrorism are being used as logistical hubs by Islamic State networks.
There is some precedent for this. Portugal was used as a logistical hub by the Basque terrorist group ETA. According to the Spanish judge Baltazar Garzon, Garikoitz Azpiagu, the leader of the Basque Terrorist Group ETA, deployed two operatives to Portugal between 2003 and 2008 to study the possible creation of logistical hubs and to establish a permanent base of operation.124 Once stationed in Lisbon, the operatives rented apartments, stole documents and vehicles, and prepared false license plates.125
For several years, Portugal became a hub of ETA activity. In June 2007, a car rented in Quarteira, in the south of Portugal, was found abandoned in Ayamonte with 115 kilogram of ammonium nitrate and detonators.126 In August that same year, a group of ETA terrorists used a vehicle with a Portuguese license plate to commit a terrorist attack against the Guardia Civil in Durango headquarter.127 In January 2010, two terrorists were detained in the village of Moncorvo while transporting 10 kilograms of explosives, three firearms, and a pack of French license plates.128 And in February that year, the Judiciary Police uncovered a house in the region of Óbidos containing hundreds of kilograms of explosives.129 CTC
Nuno Tiago Pinto is an investigative reporter and executive editor at Sábado news magazine. He authored the books Os combatentes portugueses do Estado Islâmico (The Portuguese fighters in the Islamic State); Heróis Contra o Terror: Mário Nunes, o português que foi combater o Estado Islâmico (Heroes Against Terror: Mário Nunes, the Portuguese that went to fight the Islamic State); and Dias de Coragem e Amizade – Angola, Guiné e Moçambique: 50 Histórias da Guerra Colonial (Days of Courage and Friendship – Angola, Guinea and Mozambique: 50 Stories from Portuguese Colonial War). Follow @ntpinto23
Substantive Notes
[a] The result of this investigation was published simultaneously on August 9, 2018, in Portugal, Spain, Belgium, and Germany. Nuno Tiago Pinto, “Como Portugal ajudou a desmantelar uma rede jihadista europeia,” Sábado, August 9, 2018; Daniel Montero, “Estado Islámico ocultó a terroristas como exiliados políticos para organizar desde España atentados en Francia,” El Español, August 9, 2018; Guy Van Vlierden, “Netwerk niet opgerold na aanslagen Brussel: Belgen waren geldkoeriers voor nieuwe terreur IS,” Het Laatste Nieuws, August 9, 2018; Miguel Helm, “In letzter Sekunde,” Die Zeit, August 8, 2018.
[b] According to the Portuguese Asylum law n.º27/2008, June 30, all similar requests have to be evaluated and the applicants housed until there is a final decision.
[c] On July 22, 2018, all terrorism charges against Abdesselam Tazi were dismissed. The Public Prosecutor in charge of the investigation appealed that decision to a higher court, which has not yet ruled on the matter. At the time of writing, Tazi is still detained in a high-security facility.
[d] On March 31, 2016, Tazi and el-Hanafi took a Ryanair flight from Stuttgart to Manchester. They were prevented from entering the United Kingdom due to the use of false documents: Tazi had a forged Finnish passport under the name of Tomas Engelbrechtsen and Hicham el-Hanafi a false French passport under the name of Florian Tesoro. The following day, they were deported to Stuttgart on another Ryanair flight. Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, pp. 7,249 and 7,250.
[e] On November 4, 2015, Abdesselam Tazi was identified by the Dusseldorf Police in possession of a false Finnish passport in the name of Adam Amir. On March 31, 2016, Abdesselam Tazi tried to enter the United Kingdom with a false Finnish passport under the name of Tomas Engelbrechtsen. Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, pp. 7,212-7,213.
[f] The subordinates in question were the French Islamic State operative Salah Gourmat and the Belgian Islamic State operative Sammy Djedou. “Statement by Pentagon Press Secretary Peter Cook on Coalition Strike Against ISIL External Attack Operatives,” December 13, 2016; Jérémie Pham-Lê, “13-Novembre: qui sont les deux jeunes émirs de Daech éliminés à Raqqa?” L’Express, December 13, 2016.
Citations
[1] Elise Vincent, “Un projet présumé d’attaques terroristes simultanées ‘déjoué’ en France,” Le Monde, November 21, 2016.
[2] He is referred to as Hicham EL HANAFI in court documents.
[3] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, p.731. In August 2015, Portugal issued a discreet surveillance request under article 36 of the Schengen Information System. The purpose of this alert is to obtain information on persons or related objects for the purposes of prosecuting criminal offenses and for the prevention of threats to public or national security.
[4] Adam Nossiter, “French Terrorism Suspects Appeared Anything But,” New York Times, December 14, 2016.
[5] Paris prosecutor François Molins press conference, November 25, 2016.
[8] Ibid.
[9] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, p. 2.
[10] Author interview, Mohammed Amine Hanafi, July 2018, Lisbon, Portugal.
[11] Abdesselam Tazi, born in Fez, January 1, 1954. Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, border patrol information, p. 730.
[12] Author interview, Mohammed Amine Hanafi, July 2018, Lisbon, Portugal.
[13] Cour d’Appel de Paris, Section anto-terroriste, Procès verbal d’interrogatoire de Hicham el-Hanafi, October 11, 2017, file D1171, p. 2.
[14] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, p. 3,626.
[15] Ibid.
[16] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, pp. 7,129, 7,130, and 7,215.
[17] Ibid., p. 3.
[18] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, pp. 7,210, 7,212, and 7,227.
[19] Asylum law n.º27/2008, June 30.
[20] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, interrogation of Mohammed Amine Hanafi, p. 3,671.
[21] Author interview, Mohammed Amine Hanafi, July 2018, Lisbon, Portugal.
[22] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, interrogation of Mohammed Amine Hanafi, p. 3,673.
[23] Author interview, Mohammed Amine Hanafi, July 2018, Lisbon, Portugal.
[24] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, interrogation of Mohammed Amine Hanafi, p. 3,673.
[25] Ibid.
[26] Pinto, “Como Portugal ajudou a desmantelar uma rede jihadista europeia.”
[27] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, analysis of Abdesselam Tazi and Hicham el-Hanafi travels, p. 5,384.
[28] Ibid., surveillance operation, pp. 1,696-1,698.
[29] Ibid., public prosecution, p. 7,233.
[30] Ibid., information, p. 219.
[31] Ibid., information from Belgian authorities, p. 869.
[32] Author interviews, Portuguese intelligence and counterterrorism officials, July 2018.
[33] Ibid.
[34] “Two UK men who paid Brussels bombing suspect to be sentenced,” Press Association (UK), December 12, 2016; Martin Evans, “Two guilty of funding Man in the Hat terror suspect during secret Birmingham visit,” Daily Telegraph, December 6, 2016.
[35] “France charges suspected Brussels bomber over Paris attacks,” France 24, January 30, 2017.
[36] Author interviews, Portuguese intelligence and counterterrorism officials, July 2018.
[37] Ibid.
[38] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, p. 3,625.
[39] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, p. 3,861.
[40] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[41] Pinto, “Como Portugal ajudou a desmantelar uma rede jihadista europeia.”
[42] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[43] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1158, Direction Generale de La Securite Interieure, PV Nº2016/1053/AS/24, p. 1.
[44] Ibid.
[45] Ibid.
[46] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[48] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[49] Ibid.
[50] Lazard.
[51] Ibid.
[52] Author interview, Portuguese counterterrorism official, July 2018.
[53] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1158, Direction Générale de La Sécurité Intérieure, PV Nº2016/1053/AS/24, p. 1.
[54] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1144.
[55] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1084, Direction Générale de La Sécurité Intérieure, PV Nº2016/1060/64, p. 1.
[56] Matthieu Suc, “Boubakeur el-Hakim, vie et mort d’un émir français,” Mediapart, December 14, 2016; Thomas Joscelyn, “US confirms death of high-profile Tunisian Islamic State assassin,” FDD’s Long War Journal, December 12, 2016; “Paris attacks planners ‘killed in Syria,’” BBC, December 13, 2016.
[57] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1084, Direction Générale de La Sécurité Intérieure, PV Nº2016/1060/64, p. 2.
[59] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1084, Direction Générale de La Sécurité Intérieure, PV Nº2016/1060/64, p. 2.
[60] Brisard and Jackson.
[61] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1084, Direction Générale de La Sécurité Intérieure, PV Nº2016/1060/64, p. 2.
[63] Ibid.
[65] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, Files D1084, D1146, and D1158.
[66] Ibid.
[67] Ibid.
[68] Ibid.
[69] Ibid.
[70] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[71] Ibid.
[72] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1171, Procès-Verbal d’interrogatoire Hicham el-Hanafi.
[73] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, analysis of Abdesselam Tazi and Hicham el-Hanafi travels, p. 5,384.
[74] Dirección General de la Policia, Reunión de Coordinación en Eurojust, 09.06. 2017, Casos 2128/NMFR-2016 and 2299/NMPT-2016, file D01014, p. 5.
[76] Dirección General de la Policia, Reunión de Coordinación en Eurojust, 09.06. 2017, Casos 2128/NMFR-2016 and 2299/NMPT-2016, file D01014, p. 5.
[77] Ibid.
[78] Royaume du Maroc, Ministère de l’Intérieur, Direction Générale de la Surveillance du Territoire National, Bureau Central de la lutte contre le terrorisme, Procès-verbal d’audition d dénommé Yahya Nouri, surnommé Abou Omar Al-Andaloussi, File D01069, p. 7.
[79] Ibid.
[80] Ibid.
[81] Ibid., p. 8.
[82] Ibid.
[83] Ibid., p. 9.
[84] Ibid.
[85] Ibid.
[86] Ibid.
[87] Ibid., p. 10.
[88] Ibid.
[89] Royaume du Maroc, Ministère de l’Intérieur, Direction Générale de la Surveillance du Territoire National, Bureau Central de la lutte contre le terrorisme, Numéro : 131/B.C.I.J, 9/12/2016. File D01057, p. 11.
[90] Ibid.
[91] Ibid.
[92] Ibid., p. 12.
[93] Ibid.
[94] Ibid.
[95] Ibid., p.13.
[96] Ibid.
[97] Ibid.
[98] Ibid.
[99] Ibid.
[100] Ibid., p. 14.
[102] Dirección General de la Policia, Reunión de Coordinación en Eurojust, 09.06. 2017, Casos 2128/NMFR-2016 and 2299/NMPT-2016, file D01014.
[103] Cour d’Appel de Paris, section anti-terroriste, Nº du Parquet: 16-319-000720, Nº Instruction: 2113/16/13, File D1023, Commission Rogatoire Internationale au Maroc.
[104] Ibid.
[105] LKA Office Judiciaire Régional — Rhénanie du Nord- Westphalie (NRW), Echange d’informations EK Lima / LKA NRW, Présentation Eurojust 9/6/2017.
[106] Miguel Helm, “In letzter Sekunde,” Die Zeit, August 8, 2018.
[107] Author interview, Portuguese counterterrorism official, March 2017.
[109] Ibid.
[110] Abdesselam Tazi letters to the author, May, June, July, and August 2017.
[111] Ibid.
[112] Departamento Central de Investigação e Acção Penal, judicial inquiry 78/15.2JBLSB, interrogation of Abdesselam Tazi, p. 6,793.
[113] Nuno Tiago Pinto, “Juiz diz que não há provas de terrorismo,” Sábado, June 22, 2018.
[114] Ibid.
[115] “Suspeito de terrorismo começou a ser julgado em Aveiro por falsificação,” Lusa, October 9, 2018.
[116] Author interview, Lopes Guerreiro, July 2018.
[117] Antoine Bonin, “Embringués sans le savoir dans une affaire terroriste,” Dernières Nouvelles d’Alcasse, July 11, 2018.
[118] Montero, “Estado Islámico entregó instrucciones concretas.”
[119] Helm.
[120] Rukmini Callimachi, “Not ‘Lone Wolves’ After All: How ISIS Guides World’s Terror Plots From Afar,” New York Times, February 4, 2017; Alexander Meleagrou-Hitchens and Seamus Hughes, “The Threat to the United States from the Islamic State’s Virtual Entrepreneurs,” CTC Sentinel 10:3 (2017).
[121] Author interview, Portuguese counterterrorism intelligence official, June 2018.
[122] Nuno Tiago Pinto, “Secretas europeias impediram 12 atentados este ano,” Sábado, December 12, 2018.
[123] Ioannis Mantzikos, “The Greek Gateway to Jihad,” CTC Sentinel 9:6 (2016).
[124] Nuno Ribeiro, “ETA tem mais casas de apoio em Portugal,” Público, March 13, 2010.
[125] Ibid.
[126] “Encontrado provável esconderijo da ETA em Portugal,” Visão, February 5, 2010.
[127] Ibid.
[128] Ibid.
[129] Ribeiro.
