Abstract: A decade ago, the terrorist attacks in Paris illustrated the risks and challenges posed by complex coordinated terrorist attacks (CCTA) in a Western capital. These marauding attacks, striking multiple scenes in quick succession, were different from the bombing of public transport in Madrid in 2004 and London in 2005. This article explains the evolution of the Western law enforcement response while facing such attacks, and how the 2008 Mumbai attacks and the 2015 Paris attacks led to operational and tactical evolutions in France, the United Kingdom, and the United States. The 2024 Crocus City Hall attack in Moscow demonstrates the continuing threat posed by CCTA outside of the West. The constantly evolving modus operandi used by terrorists requires a strong anticipation effort by law enforcement agencies in order to prepare for a potential return of CCTA in the West.
Ten years ago, on November 13, 2015, nine terrorists led a series of attacks in Paris and Saint-Denis organized by the Islamic State. Over the course of three hours, they killed 130 people, using assault rifles and suicide-vests, until the operators of the Brigade de Recherche et d’Intervention neutralized the last two terrorists in the Bataclan concert hall. The attacks and the use of this modus operandi—combining multiple teams carrying small arms and explosives in a dense urban area—were unprecedented in the West at the time. It illustrated the growing risk of complex coordinated terrorist attacks (CCTA) in Europe and the United States and led to strong counterterrorism efforts in France and abroad. A decade later, following the decline of the Islamic State and an evolution in terrorists’ profiles, complex coordinated terrorist attacksa in the West are becoming rare. Lone actors, using bladed weapons or perpetrating vehicular attacks, are more frequent. Yet, the 2024 Crocus City Hall Attack in Moscow, which claimed more than 140 lives, illustrates the continued necessity of planning and preparing for such future terrorist events.
First, it is important to present the succession of events that took place in Paris and its surrounding suburbs 10 years ago in order to better understand the operational and tactical challenges and impact of the 2015 Paris Attack. The second part of this article will look at the evolution of CCTA and of law enforcement responses, from the early to mid-2000s to the 2008 Mumbai attacks, then to the 2015 attacks in Paris and 2024 in Moscow. Finally, the last part of the article will explore the lessons learned from Paris and their relevance to future CCTA threat in the West.
The Impact of the Paris Attacks
On the evening of Friday, November 13, 2015, three teams of terrorists left their safe houses in the Paris suburbs to reach their objectives. Each team was made up of three terroristsb and had a distinctive target. The first team—composed of Bilal Hafdi, a 20-year-old Belgian national, and two Iraqis, Ammar Ramadan Mansour Mohamad al-Sabaawi and Mohammad al-Mahmod—targeted the Stade de France, a 78,000-seat sport facility. On the day of the attack, the stadium was hosting a soccer game, where France was facing Germany, with the French president and the German foreign minister in attendance.1 The terrorists’ plan was to detonate their suicide vests in the crowd waiting to enter the venue. Due to traffic, they were delayed and found a limited number of targets available once outside of the stadium.2 Coordinating with the second team, a first terrorist detonated his suicide vest at 9:20pm in front of Gate D, then a second one detonated his next to Gate H, and the last one at 9:53pm in front of a McDonald’s. One person was killed, and 59 others were injured.3
The second team of terrorists—led by Abdelhamid Abbaoud, the operational leader, and composed of two other Belgian nationals, Chakib Akhrou and Brahim Abdeslam—started their attack at 9:24pm in Paris. Over the course of the next 16 minutes, they targeted restaurants and bars, opening fire on patrons on outside patios. Driving around and stopping at the most crowded establishments, they opened fire in four different locations, before dropping Abdeslam at the last one, where he detonated his suicide vest. The two remaining terrorists then escaped.c Thirty-nine people were killed, and 72 injured.4
The third team reached their target, the Bataclan concert hall, at 9:40pm. It was composed of three French citizens, Samy Amimour, Ismael Omar Mostefaï, and Foued Mohamed Aggad. They parked in front of the building, opened fire on the Bataclan café, then moved inside where 1,500 spectators were attending a concert by the Californian band Eagles of Death Metal. They opened fire on the crowd from the back of the room. A private security officer rushed to open an exit, leading several hundred people out,5 before going back in and laying on the floor due to the shots from the three terrorists. After a few minutes, he was able to open a second door, leading around 100 spectators to safety. The first police response was composed of a few self-deployed officers from the BAC 94,6 who exchanged fire with the terrorists in a narrow street on the left side of the building, covering the fleeing concertgoers. Police Commissioner Guillaume Cardy and his driver, from the Paris BAC N, were the first responders to enter the building through the front door.7 As they entered the main room, they observed one of the terrorists trying to force a victim to kneel on stage. They opened fire from 25 yards away, striking Amimour, who fell on his back and deployed his suicide vest. The two remaining terrorists briefly opened fire before gathering around 20 hostages and leading them to a corridor on the first floor. The initial, small police response started to evacuate the injured victims from the building before the first officers from Paris’ top tactical unit, the Brigade de Recherche et d’Intervention (BRI), arrived on scene at 10:20pm.8 The BRI progressed through the building before encountering a closed door where the terrorists were waiting with the hostages. After more than an hour of negotiations, at 12:18am, the BRI breached the door and led a 56-second assault, neutralizing both terrorists, without any casualties among the hostages.9 However, the terrorists had been able to kill 90 people inside of the Bataclan before the arrival of law enforcement.10
Each of the teams had an operational objective to maximize harm. The attack against the stadium, the first one to take place, was designed to bring a massive law enforcement response to Saint-Denis and away from Paris, reducing the number of officers in the capital before the two other attacks. Because of the initial delay, terrorists at the stadium committed their attack too late and the law enforcement capacity in Paris was not reduced.11 The second attack, striking five targets in close proximity at a fast pace, was designed to confuse the law enforcement response. The position of the establishments attacked, most of them on street corners, led to a dispersion of the victims and a multiplication of ghost calls to emergency personnel. The professionalism of the emergency call operators and the renowned Préfecture de Police radio discipline was crucial in reducing that diversion and mapping out the different scenes. The shooting at the Bataclan was designed to be the main attack. Despite the tragic death toll, the swift and courageous response by a private security officer allowed potential victims to escape and was followed by the neutralization of one of terrorists, which stopped the killing. The operation by the BRI to release the hostages was successful, despite an extremely demanding tactical situation. The final casualties report listed 130 dead and 337 hospitalized.12
The Paris attacks, known in France as the November-13 attacks, were the deadliest terrorist attacks in the country’s recent history. In the month preceding the attacks, other incidents had already occurred, including the January 2015 attacks against Charlie Hebdo and the Hyper Kosher super market.d Yet, as then-Interior Minister Bernard Cazeneuve stated, “the terrorists’ targets have changed … if they were selected, in January 2015, because of their clear symbolic value, it was not the case on November 13th. The assassins deliberately attacked without distinction against crowds whose only common feature was they were gathered in the same places. This mass murders’ target was our way of life, and the Nation’s unity.”13 The attack led to a series of efforts by the French national security apparatus, combining military operations in Iraq and Syria, an increase in intelligence regarding French citizens fighting abroad and a complete reform of the tactical capabilities of law enforcement. The Bataclan attack also became the usual scenario for any active shooter training in France, with police and gendarmerie officers training for mass casualty attacks led by multiple assailants carrying suicide vests, for the last decade.
Outside of France, the scale of the attack was also a surprise, as Christopher O’Leary, former Unit Chief of the FBI’s elite Counterterrorism Fly Team, stated:
The U.S. CT community was expecting ISIS external ops to begin increasing its activity in Europe. This was based on the routine flow of FFs [foreign fighters] to and from Syria and Iraq in the early days, as well as intelligence indicating that ISIS was intent on expanding their activities outside of the conflict zone. However, while the U.S. CT community was concerned, there was certainly shock over the scale and sophistication of the attack, and the extensive operational coordination that ISIS demonstrated. This caught many off guard, much like LeT’s ability to conduct such a complex attack in Mumbai after an over the horizon amphibious landing … [The Paris attack] was a wake-up call that I would compare to AQ’s East Africa Embassy Bombings. Prior to 2015, the U.S. CT enterprise primarily looked at ISIS as a Middle East regional threat.14
The response from the United States was fast following the attack: “The FBI immediately deployed Special Agents, Task Force Officers, and Intelligence Analysts from both the FBI Counterterrorism Fly Team [and] the New York Joint Terrorism Task Force to partner with France and other European neighbors to conduct the investigation and mitigate follow-on attacks.”15
Complex coordinated terrorist attacks (CCTA) continued in 2016, when three suicide bombers from the remnants of the Brussels cell targeted the Zaventem airport and the Maelbeek metro station, killing 32 and injuring 130.16 The following year, on June 3, 2017, three jihadis, Khuram Butt, Rachid Redouane, and Youssef Zaghab, rammed their van into pedestrians on London Bridge in the United Kingdom, before entering Borough market and stabbing patrons in various bars and restaurant. Eight people were killed and 48 were injured in eight minutes, before armed officers from both the City of London and the Metropolitan police Specialist Firearms Command neutralized the three terrorists.17
The decline and final fall of the Islamic State’s territorial caliphate reduced the group’s ability to organize complex, coordinated terrorist attacks in the West. Over the last few years, lone actors, conducting low-tech and low-cost terrorism, turned to bladed weapons or vehicular attacks,18 sometimes with dramatic results such as in Nice on Bastille Day in 2016. Yet, law enforcement officials kept a strong interest in CCTA, learning from the recent history of the phenomenon.
The Evolution of Complex Coordinated Terrorist Attacks
CCTA in the early 2000s, such as the March 11, 2004, attack in Madrid19 or the 7/7 bombers in London20 in 2005, saw the quasi-simultaneous use of explosive devices in an urban area, mostly targeting public transportation, and leading to a vast number of casualties. Because of the immediacy of the attacks, the law enforcement response to this type of incident was twofold. Before the attack, officers could try detecting and then defusing the device(s), which was extremely difficult in busy public transport locations and with no early warnings. After the attack, the priority was to secure the scene, investigate, and arrest the terrorist(s) responsible before another potential future attack.
The 2008 Mumbai attack represented an important evolution of CCTA. On November 26, 2008, 10 members of the Pakistani jihadi group Lashkar-e-Taiba committed coordinated attacks in 12 locations in Mumbai.21 After extensive training in Pakistan,22 the terrorists hijacked a fishing trawler and landed in south Mumbai where they separated into four teams, taking different cabs where they hid RDX-based explosives.23 Each one had a designed objective: a Jewish outreach center, the Oberoi Trident Hotel, the Chhatrapati Shivaji Terminus, and their main objective, the Taj Mahal Hotel. Working in two-person teams, except at the Taj Mahal Hotel where four terrorists were gathered, they used fully automatic, Chinese-made AK-47 assault rifles, with around 210 rounds of ammunition, a 9mm pistol, and “eight to ten grenades” each24 in order to attack crowds and law enforcement. The explosives left in the taxis added to the confusion when they exploded a few hours later. At the Taj Mahal Hotel, where the attack ignited a massive fire, the terrorists took hostages and held a siege for 68 hours, until Marine (MARCOS) and National Security Guards (NSG) commandos were able to neutralize them. One hundred and sixty-six people were killed, and over 300 were injured.25
The Mumbai attacks, often described as a fedayeen-style26 attack, led to a series of operational and tactical debates among Western law enforcement agencies. The reality of a series of coordinated urban assaults—striking multiple targets simultaneously and combining the use of IEDs and firearms in a complex urban environment—all designed to grab worldwide media attention was truly concerning. In the United States, most tactical training at the time was designed to face the most common form of attack: an active shooter situation where the perpetrator is usually a lone actor. Even during attacks with two assailants, such as the Jonesboro shooting in 199827 or the Columbine shooting in 1999,28 the perpetrators rarely separated during the assault. The Mumbai attacks, now categorized as a “marauding terrorist attack,”29 illustrated the risk of a larger-scale assault with few effective operational law enforcement tools available. Al-Qa`ida tried to organize similar attacks in Europe, leading to a number of arrests in the fall of 2010 by U.S., French, British, and German security services.30
Practitioners from law enforcement agencies recommended a series of evolutions to the operational response processes, which spurred change. In the United States, the law enforcement community developed the Multi-Assault Counter Terrorism Action Capabilities (MACTAC), a response plan based on combining personnel or operations to assist local jurisdictions responding to major attacks, including multiple shooter assaults. Building on the progress of the Immediate Action Rapid Deployment (IARD),31 MACTAC enabled the deployment of multiple contact teams at various locations in an urban area. MACTAC response was fortunately not used in operation, since no CCTA attacks occurred in the United States. However, following the 2017 Las Vegas shooting, where ghost calls led to early rumors of a CCTA, the Las Vegas Police Department stated that the “heavy local investment in Multi-Assault Counter-Terrorism Action Capabilities (MACTAC) … also proved especially valuable.”32 In Europe, other tactical evolutions were developed. In the United Kingdom, where the vast majority of law enforcement are patrolling unarmed, counter-terrorism specialist firearms officers (CTSFOs) were recruited and trained following the Mumbai attacks in 2008 and the Westgate mall attack in Kenya in 2013, moving from an armed military response to a law enforcement one.33 Programs implementing better coordination with fire departments were organized, to prevent ‘fire as a weapon’ situations from occurring. In France, the Force d’Intervention de la Police Nationale (FIPN) was inaugurated on December 1, 2009,34 putting most of the National Police tactical units into a single command system, which can be temporarily activated during a crisis by the commander of the RAID, the French national tactical team. The BRI-PP35 and the RAID36 then developed fast response units capable of transporting a limited number of officers quickly to the scene of the attack. One of the main differences between U.S. and European responses to CCTA after the Mumbai attacks was the type of units they involved. While law enforcement in the United States favors a faster response based on a limited number of patrol officers, described by Blair and Martaindale as “the move toward solo response,”37 the European response after the Mumbai attacks was still based on a limited number of elite units.
Despite their similarity, differences between the Paris and Mumbai attacks were numerous. On the terrorists’ side, the Mumbai attackers benefited from extensive reconnaissance work and intelligence gathering by LeT-tasked operative David Headley,38 e in addition of the help of a communication center in Pakistan that shared live information about law enforcement responses and advised the operatives during the siege at the Taj Mahal Hotel. The Indian law enforcement response to the Mumbai attack, despite the bravery of the officers involved, was limited by a lack of resources, poor planning for such a crisis, and jurisdictional issues which greatly delayed the ability of Indian counterterrorism elements to quickly respond. Delays, limited communication, and one terrorist’s desertion had plagued the terrorists in Paris.f The law enforcement response in Paris, notwithstanding the ill-adapted doctrine and equipment, was fast and effective. The first law enforcement officers on the various scene faced a scenario they were not ready for, with only handguns and class III ballistic protections. CCTA response was perceived to be led by elite tactical units, and not first responders. Yet, the initial response at the Bataclan by the BAC N commissioner and his driver, followed by the impressive assault by the BRI-PP, prevented an extended siege similar to the one in Mumbai.
The scale of the damage and the media impact was unprecedented in a Western city. Law enforcement agencies were concerned about a “copycat effect” in Western urban centers and in France specifically. In France, the Ministry of Interior led a complete tactical reform, made easier by a highly centralized law enforcement community, with only two principal agencies, the French National Police and the French National Gendarmerie. Law enforcement personnel were divided in three tactical groups. At the top, the level 3 groups, also called specialized intervention groups, the Brigade de Recherche et d’Intervention (BRI), the RAID (recherche, assistance, intervention, dissuasion) and the Groupe d’Intervention de la Gendarmerie Nationale (GIGN),g were in charge of the most complex situations. Then, level 2 tactical units, such as the Police Brigade Anti-Criminalité (BAC) and the Gendarmerie Peloton de Surveillance et d’Intervention de la Gendarmerie (PSIG), received assault-rifles and level-4 ballistic protection, extended training, and more officers. The rest of police and gendarmerie officers, considered level 1 units, were now trained to engage the shooter as fast as possible, and saw the recruitment of an additional 9,000 officers,39 in addition of the thousands of reservists who joined the Gendarmerie.40 An additional 233 million euros was also allocated to the Ministry of Interior to support this tactical reform in 2016. In the United Kingdom, a few days after the Paris attacks, the Home Office stated that it had “detailed plans for dealing with these kind of attacks,” adding that “since the attacks in Mumbai in 2008,” they had improved the “police firearms response, buil[t] the capability of our police and the speed of [their] military response” but also emergency preparedness in case of “marauding gun attacks.” The UK Strategic Defence and Security Review asked for a 15 percent increase of the funding available to the security and intelligence agencies in order to hire an additional 1,900 officers.41 In the United States, Congress appropriated $50 millionﾊto the Department of Homeland Security in 2016 in order to improve CCTA response capabilities through the Federal Emergency Management Agency (FEMA). Local initiatives by a number of U.S. states also led to grants for CCTA programs.42
As stated earlier, the fall of the Islamic State’s territorial caliphate in Syria and Iraq led to a change in the jihadis’ modus operandi, from CCTA to inspired and enabled lone actor attacks. This decline led to a logical change in the perception of the threat by law enforcement. The necessity to respond daily to a number of different crises and challenges can lead to a loss of capability, and a lack of anticipation of rare black swan events such as CCTA. However, although rare, CCTA attacks are a recurring phenomenon, as illustrated by the 2024 Moscow attack at the Crocus Hall. On March 22, 2024, four jihadis from Tajikistan attacked the Crocus City Hall in Krasnogorsk, in the Moscow Oblast. The attack took place during preparations for a sold-out concert by the band Picnic, with a concert hall capacity of approximately 7,000 spectators. At 7:58pm, the terrorists exited their vehicle in front of the facility and opened fire on the security guards, most of them being unarmed or lightly armed. They then proceeded to the concert hall where they attacked the crowd using assault rifles, knives and petroleum bombs, after blocking the exits. The four terrorists escaped by car at 8:11pm, striking and seriously injuring an eight-year-old boy and his 11-year-old sister. The attack lasted a total of 13 minutes yet led to 149 fatalities43 and around 600 injured.44 The fire spread rapidly, raging over a large area of 12,900 square meters,45 and was responsible for most of the casualties. Ambulance and fire departments vehicles arrived soon after the terrorists’ departure and worked through the night. The law enforcement response, composed of the SOBR (Special Rapid Response Unit) and OMON (Special Purposes Mobile Unit), were dispatched at 8:30pm. The four terrorists, linked to Islamic State Khorasan Province (ISK), were arrested the next day. The Crocus City Hall attack illustrated that complex coordinated terrorist attacks are still a relevant strategy for terrorist groups outside of the West, and should remain an area of concern for Western security and law enforcement as a result.
Lessons Learned from Paris
Ten years later, it is important to not lose sight of the lessons learned from the Paris attacks. Jeremy M., a BRI team leader and an FBI National Academy graduate, explains that “passing these lessons took time, for both experienced and new operators. It is now fully integrated as part of everyone’s training.” He also notes that “beyond passing on the lessons learned, integrating the new ‘post-Bataclan’ operators was not easy,” as the schism between operators who were present during the attacks and new recruits took time to fix. Despite the change of format in terrorism in France since 2015, French law enforcement keeps improving its CCTA response. Loic T., in charge of training at the BRI, explains that “each BRI operator receives around 500 hours of training per year, including both individual and team training.”46 He underlines the impact of the organization of recent major events in Paris: “The two major events of last year, the Olympics and the Inauguration of Notre Dame de Paris, made me believe that we improved both our capability and our capacity.”47
Lessons learned from the Paris attacks are numerous, yet a few core principles need to be understood. First, due to the speed of these types of attacks, the first responders will be local patrol officers. They will have to act fast, with limited information, to prevent further loss of life by neutralizing the threat. Despite being the most crucial part of the response, they are also the least trained, often lacking in equipment, weaponry, and experience. The professionalism and courage shown during the Paris attacks proved their importance, but cannot be a substitute for further training. “It’s fundamental that they have the right diagnostic and that they understand that if the killing is going on, they must intervene,” explained Jeremy from the BRI.48 Loic T. confirmed that “there is a strong probability that they will neutralize the threat before we arrive on scene.” While elite units such as the BRI-PP have access to resources and expertise, it is essential to include local officers in these training efforts. Providing realistic and regular training opportunities for local patrol officers is therefore especially important to improve the law enforcement response to a complex coordinated terrorist attack.
Complex coordinated terrorist attacks require complex coordinated responses. Integration of various actors, agencies, and capabilities into a single efficient effort is a key objective for Western security services. The BRI explained that integrating “not only law enforcement, but rescue and fire, military personnel from Operation Sentinelle,h and corporate security senior executives from sensitive sites” is crucial and that “today, during major events such as the Olympics or the Notre Dame inauguration, every unit is able to work with each other, even coming from a different ministry, and to provide support to each other.”49 This integration is made easier by the heavily centralized French law enforcement system but might be more difficult in an environment with more jurisdictions and agencies, such as the United Kingdom or the United States, despite the implementation of memorandums of understanding between police departments. Outside of large urban centers, such as Mumbai, Paris, or Moscow, CCTAs in a smaller town or a rural area could be devastating, due to the lack of resources. Delays affecting first responders and reinforcement in remote areas should then be considered while planning the response to a complex coordinated terrorist attack.
Finally, potential evolutions of the CCTA threat should be closely monitored in order to better anticipate them. The role of liaison officers is therefore crucial to better understand the lessons learned from foreign partners. Thierry Sabot, the current commander of the Brigade de Recherche et d’Investigations of Paris, explained: “The Paris Attacks led to an increased demand for international cooperation, due to the format of the attack and the way the response was organized. Numerous foreign units recognized the efficiency of the response of the French units like the BRI, leading to the neutralization of the terrorist threat without adding to the initial number of victims.” These types of exchanges between law enforcement agencies are especially important to share lessons learned. The addition of analysts inside tactical units could also give them a more global, constantly updated, vision of the threat they will face. Apart from these examples in the West, a number of cases from abroad, including the Westgate Mall attack in 2013,50 the Radisson Blue in 2015 in Bamako,51 Mali, the Grand Bassam attack in Ivory Coast in 2016,52 and the Dusit D2 attack in 2019 in Kenya,53 can be especially useful to Western law enforcement.
The threat from CCTA is adaptive and terrorists have shown their ability to design new ways to commit attacks, from the maritime landing in Mumbai to the three different objectives of the Paris attacks. Therefore, imagination and red teaming should be implemented more frequently at every level of the law enforcement response. Thierry Sabot explained: “Our R&D effort focused on two modus operandi. First vehicular attacks, where the BRI is looking of efficient equipment to neutralize a vehicle from afar, in addition to the usual bollards. Second, we are looking at drone attacks, after their use in Israel and during the conflict in Ukraine.”54 Jeremy M. adds that it was necessary to ﾇwork closely with the special operation community, because … close quarter combat was not part of the law enforcement culture [in France].”55 Others recent developments could affect the CCTA threat environment in the West, such as the availability of firearms in Europe. Both 3D printed weapons and exports from the conflict in Ukraine have been used in low scale terrorist attack in Europe,i and could be used by terrorist in a CCTA. Fire as a weapon has also been used in both Mumbai in Moscow with devastating effect and requires fast-paced coordination between law enforcement agencies and fire departments. Finally, disruptive social media campaigns, both during and after CCTAs, can create confusion, reduce the efficiency of law enforcement responses, and lead to other social impacts.
Speed of action, the need for integrated incident command, anticipation, and constant adaptation are among the key lessons learned from the Paris attacks. Ten years later, as complex coordinated terrorist attacks are less frequent in the West, it remains important to stay vigilant and prepared to face a potential return of the threat. CTC
Alexandre Rodde is a Visiting Fellow at the Protective Security Lab at Coventry University and an Associate Researcher at the Gendarmerie National Research Center (CRGN). He works as a security consultant and analyst, specializing in terrorism, mass shootings, and violent extremism in the French national security apparatus. He is the author of Le Jihad en France: 2012-2022 (not yet available in English).
© 2025 Alexandre Rodde
Substantive Notes
[a] According to the National Security Counter Terrorism Security Office of the United Kingdom: “There is no formal definition of what constitutes a ‘complex attack’. Terrorist attacks exhibit varying degrees of complexity – from high to low – depending on a number of characteristics. Characteristics of the most complex terrorist attacks include the use of well-prepared, well-trained and well-armed attackers, adopting military-style tactics, as well as striking multiple targets in a co-ordinated way.” “Complex Attack,” National Security Counter Terrorism Security Office of the United Kingdom, March 11, 2022.
[b] Salah Abdeslam, the 10th terrorist and lone survivor of the attack, was supposed to act alone and use his suicide vest in the Paris 18th district. Instead, he abandoned his vest in a dumpster and called a contact in Brussels to pick him up. He was part of the planning of the March 2016 Brussels attack, but was arrested before the attacks took place.
[c] Akhrou and Abbaoud were neutralized five days later in a squat in Saint-Denis. On the night of the attack, after leaving their car outside of Paris, they used a train to come back and were part of the crowd watching the Bataclan police operation unfold.
[d] The Charlie Hebdo attack took place on January 7, 2015; the Hyper Kosher supermarket attack was on the 9th. On the 8th, a police officer, Clarissa Jean-Philippe, was murdered by the same jihadi who attacked the supermarket the next day.
[e] David Headley, born Dawood Sayed Gilani, is a Pakistani American national and a former DEA informant. He joined Lashkar-e-Taiba and led a series of reconnaissance mission in Mumbai before the 2008 attacks, staying for extended period in the Taj Mahal Hotel. He was convicted in 2013 for his part in planning the attacks and received a 35-year sentence.
[f] The first attack at the stadium was delayed because of traffic, limiting its effect. No communications between the operators and the planners in Syria and Iraq during the attack were reported. Salah Abdeslam, the 10th terrorist, defected and fled to Brussels on the night of the attacks.
[g] The BRI-PP is responsible for Paris and its close suburbs; the RAID is in charge of the rest of the cities in France. Both are part of the French National Police. The Groupe d’Intervention de la Gendarmerie (GIGN) is in charge of the rest of the countryside in France.
[h] Since January 2015, between 3,000 to 10,000 armed forces personnel are deployed in large and medium cities in France to protect the population.
[i] 3D-printed firearms were used in the far-right Halle attack in Germany in October 2019, and an assault rifle from Ukraine was used in the 2023 Brussels jihadi attack that killed two Swedish supporters.
Citations
[1] Alexandre Rodde, Le Jihad en France 2012-2022 (Paris: Editions du Cerf, 2022), pp. 146-148.
[2] Ibid., p. 185.
[3] Ibid., pp. 146-148.
[4] Rodde, p. 187.
[5] Ibid., p. 162.
[6] Laura Nattiez, Denis Peschanski, and Cécile Hochard, 13 Novembre : Des témoignages, un récit (Paris: Odile Jacob, 2020), p. 172.
[7] “Guillaume Cardy, l’un des premiers policiers à être intervenu lors de l’attaque du Bataclan, nommé patron du Raid,” Figaro, December 1, 2023.
[8] Rodde, p. 170.
[9] Ibid., p. 194.
[10] Ibid., p. 191.
[11] Ibid., p. 185.
[12] Mathieu Raux, Pierre Carli, Frédéric Lapostolle, Matthieu Langlois, Youri Yordanov et al., “Analysis of the medical response to November 2015 Paris terrorist attacks: resource utilization according to the cause of injury,” Intensive Care Medicine 45:9 (2019): pp. 1,231-1,240.
[13] Bernard Cazeneuve, “Déclaration de M. Bernard Cazeneuve, ministre de l’intérieur, sur le ‘schéma national d’intervention’ pour coordonner les unités d’élite (RAID, GIGN et BRI) et mieux utiliser leurs capacités respectives en cas d’attentats de masse, à Paris le 19 avril 2016,” Vie Publique, April 19, 2016.
[14] Author correspondence, Christopher O’Leary, September 2025.
[15] Author correspondence, Christopher O’Leary, September 2025.
[16] “Mémorial des victimes des attentats de Bruxelles,” Libre (online), n.d.
[17] Anthony Lane, “Eight Minutes of Terror at London Bridge,” New Yorker, June 4, 2017.
[18] Alexandre Rodde and Justin Olmstead, “Into the Crowd: The Evolution of Vehicular Attacks and Prevention Efforts,” CTC Sentinel 18:3 (2025).
[19] Sandrine Morel, “Madrid’s wounds after the March 11, 2004 attacks are still open, 20 years on,” Monde, March 11, 2024.
[20] Raffaello Pantucci, We Love Death as You Love Life: Britain’s Suburban Terrorists (New York: Hurst, 2015), pp. 185-198.
[21] “Mumbai Terror Attacks Fast Facts,” CNN, November 11, 2022.
[22] Cathy Scott-Clark and Adrian Levy, The Siege: 68 hours inside the Taj Hotel (New York: Penguins Book, 2013), pp. 102-127.
[23] Daveed Gartenstein-Ross and Daniel Trombly, “The Tactical and Strategic Use of Small Arms by Terrorists,” Foundation for Defense of Democracies, October 2012.
[24] Ibid.
[25] Bruce Riedel, “Killers in the Neighborhood,” Brookings, November 22, 2013.
[26] “Protecting the Homeland Against Mumbai-style Attacks and the Threat From Lashkar-e-Taiba Hearing Before the Subcommittee on Counterterrorism and Intelligence of the Committee on Homeland Security,” House of Representatives, One Hundred Thirteenth Congress, First Session, June 12, 2013.
[27] Katherine S. Newman, Rampage: The Social Roots of School Shootings (New York: Basic Book, 2004), pp. 7-14.
[28] Hon. William H. Erickson, “The Report of Governor Bill Owens’ Columbine Review Commission,” May 2001.
[29] “What is a Marauding Terrorist Attack?” National Protective Security Authority (United Kingdom), August 11, 2025.
[30] Gartenstein-Ross and Trombly.
[31] “Immediate Action Rapid Deployment (‘IARD’) – Backgrounder,” National Police Federation (Canada), March 23, 2022.
[32] “1 October After-Action Report,” Federal Emergency Management Agency, August 24, 2018.
[33] Vikram Dodd, “Scotland Yard creates SAS-style unit to counter threat of terrorist gun attack,” Guardian, June 29, 2015.
[34] Eric Pelletier, “Lancement de la Force d’intervention de la police nationale,” L’Express, December 1, 2009.
[35] Rodde, p. 170.
[36] Jean Michel Fauvergue, La Sécurité des Français (Paris: Michel Lafon, 2019), p. 139.
[37] Hunter Martaindale and J.P. Blair, “The Evolution of Active Shooter Response Training Protocols Since Columbine: Lessons From the Advanced Law Enforcement Rapid Response Training Center,” Journal of Contemporary Criminal Justice 35:1 (2019).
[38] Scott-Clark and Levy, pp. 33-58.
[39] Cazeneuve.
[40] Céline Morin (Cpt), “Montée en puissance de la réserve opérationnelle,” Gendinfo, September 5, 2016.
[41] Amber Rudd, “Home Secretary’s statement to the House on the terrorist attacks in Paris,” November 16, 2015.
[42] “Effectiveness of the Program to Prepare Communities for Complex Coordinated Terrorist Attacks and the Countering Violent Extremism Grant Program,” Federal Emergency Management Agency, Fiscal Year 2017 Report to Congress, June 26, 2018.
[43] Pjotr Sauer, “Suspected gunmen go on trial in Moscow over concert hall terror attack,” Guardian, August 4, 2025.
[44] “Trial begins for suspects in 2024 Moscow concert hall attack that killed 149 people,” Associated Press, August 4, 2025.
[45] “Fire at Crocus City Hall contained on 12,900 square meters – Russian Emergency Situations Ministry’s Main Directorate for Moscow region,” Interfax Russia, March 23, 2024.
[46] Author correspondence, Loic T., September 2025.
[47] Ibid.
[48] Author interview, Jeremy M., September 2025.
[49] Author interview, Loic T., September 2025.
[50] Erin Miller, “Al-Shabaab Attack on Westgate Mall in Kenya,” Global Terrorism Database, START, September 2013.
[51] “Alleged planner of Mali Radisson Blu hotel attack goes on trial,” BBC, October 27, 2020.
[52] “Seven years on, Ivorian beach resort of Grand-Bassam still scarred by deadly attack,” France 24, March 31, 2023.
[53] “Terrorists in Dusit D2 Attack Convicted,” Directorate of Criminal Investigation (Kenya), May 22, 2025.
[54] Author interview, Thierry Sabot, September 2025.
[55] Author interview, Jeremy M., September 2025.
