Including Mr. Boudina, at least 21 fighters trained by the Islamic State in Syria have been dispatched back to Europe with the intention of causing mass murder, according to a Times count based on records from France's domestic intelligence agency. The fighters arrived in a steady trickle, returning alone or in pairs at the rate of one every two to three months throughout 2014 and the first part of 2015.
Facebook Q. & A.
Rukmini Callimachi, a foreign correspondent who covers Islamic extremism, will answer readers' questions at 1 p.m. Eastern time on Tuesday about the Islamic State's efforts to attack Europe. Join her at facebook.com/nytimes.
Like the killers in Paris and Brussels, all of these earlier operatives were French speakers — mostly French and Belgian citizens, alongside a handful of immigrants from former French colonies, including Morocco.
They were arrested in Italy, Spain, Belgium, France, Greece, Turkey and Lebanon with plans to attack Jewish businesses, police stations and a carnival parade. They tried to open fire on packed train cars and on church congregations. In their possession were box cutters and automatic weapons, walkie-talkies and disposable cellphones, as well as the chemicals to make TATP.
Most of them failed. And in each instance, officials failed to catch — or at least to flag to colleagues — the men's ties to the nascent Islamic State.
Photo Mehdi Nemmouche killed four people at the Jewish Museum of Belgium in May 2014. Despite evidence of his ties to ISIS, a Belgian prosecutor said at the time, "He probably acted alone." Credit Agence France-Presse — Getty Images
In one of the highest-profile instances, Mehdi Nemmouche returned from Syria via Frankfurt and made his way by car to Brussels, where on May 24, 2014, he opened fire inside the Jewish Museum of Belgium, killing four people. Even when the police found a video in his possession, in which he claimed responsibility for the attack next to a flag bearing the words "Islamic State of Iraq and Syria," Belgium's deputy prosecutor, Ine Van Wymersch, dismissed any connection.
"He probably acted alone," she told reporters at the time.
Though the degree to which the operatives were being directed by the Islamic State might have been unclear at first, a name began to appear in each successive investigation: Abdelham id Abaaoud, a Belgian citizen who counterterrorism officials say rose through the ranks to become a lieutenant of the Islamic State's external operations efforts.
In the months before the Jewish museum attack, Mr. Nemmouche's phone records reveal that he made a 24-minute call to Mr. Abaaoud, according to a 55-page report by the French National Police's antiterror unit in the aftermath of the Paris attacks.
"All of the signals were there," said Michael S. Smith II, a counterterrorism analyst whose firm, Kronos Advisory, began briefing the United States government in 2013 on ISIS' aspirations to strike Europe. "For anyone paying attention, these signals became deafening by mid-2014."
It was in the summer of 2014 that the link to the terrorist organization's hierarchy became explicit.
On June 22 of that year, a 24-year-old French citizen named Faiz Bouchrane, who had trained in Syria, was smuggled into neighboring Lebanon. He was planning to blow himself up at a Shiite target, and during interrogation, he let slip the name of the man who had ordered him to carry out the operation: Abu Muhammad al-Adnani.
Mr. Adnani is the spokesman for ISIS and is considered one of its most senior members. Just a few days after Mr. Bouchrane checked into a budget hotel in Beirut, Mr. Adnani released an audio recording announcing the establishment of the caliphate.
"Adnani reportedly leads the external operations planning of the Islamic State," said Matthew G. Olsen, the former director of the National Counterterrorism Center.
State of Terror
Articles in this series examine the rise of the Islamic State and life inside the territory it has conquered.
Intelligence officials in the United States and Europe have confirmed the broad outlines of the external operations unit: It is a distinct body inside ISIS, with its command-and-control structure answering to Mr. Adnani, who reports to Abu Bakr al-Baghdadi, the self-proclaimed caliph of the Islamic State.
The unit identifies recruits, provides training, hands out cash and arranges for the delivery of weapons once fighters are in position. Although the unit's main focus has been Europe, external attacks directed by ISIS or those acting in its name have been even more deadly beyond Europe's shores. At least 650 people have been killed in the group's attacks on sites popular with Westerners, including in Turkey, Egypt and Tunisia, according to a Times analysis.
Within the hierarchy, Mr. Abaaoud was specifically tasked with mounting attacks in Europe, according to the French police report and intelligence brief.
"Abaaoud, known as Abou Omar, was the principal commander of future attacks in Europe," Nicolas Moreau, a French jihadist who was arrested last year, told his French interrogators, according to the report by France's antiterror police. "He was in charge of vetting the applications of future candidates."
Pacing AttacksPhoto In a 2014 audio recording, Abu Muhammad al-Adnani, a spokesman for the Islamic State, called on Muslims everywhere to kill Europeans, "especially the spiteful and filthy French."
In an audio recording released on Sept. 22, 2014, Mr. Adnani, the ISIS spokesman and chief of the external operations wing, addressed the West.
"We will strike you in your homeland," he promised, calling on Muslims everywhere to kill Europeans, "especially the spiteful and filthy French." And he urged them to do it in any manner they could: "Smash his head with a rock, or slaughter him with a knife, or run him over with your car," he said, according to a translation provided by the SITE Intelligence Group, which monitors extremist propaganda.
In the months that followed, a man decapitated his employer near the French city of Lyon, sending a snapshot of the severed head to the Islamic Sta te. Another man stormed a police station in Paris, carrying a butcher's knife and a photocopy of the Islamic State's flag.
These are among around two dozen plots linked to the Islamic State that were documented in the year after Mr. Adnani's speech. In most, there were no direct operational ties back to Syria, but there were clear signs that the attacker had consumed the terrorist group's propaganda online.
The low potency of these attacks, with single-digit death tolls, combined with the fact that many of the perpetrators had a history of mental illness, prompted analysts and officials to conclude that the Islamic State remained a distant second to Al Qaeda in its ability to carry out attacks on Western soil.
Experts now believe that the Islamic State was actually adopting a strategy first put forward by an earl ier operations leader for Al Qaeda, who argued that the group would become obsolete if it worked only on 9/11-size plots that took months or years to mount. He instead called for Al Qaeda to also carry out a patter of small- and medium-size plots, and to use propaganda to inspire self-directed attacks by supporters overseas.
In a recent issue of its online magazine in French, Dar al-Islam, the Islamic State explained the approach. "The Islamic State has deployed its resources to generate three types of terrorist attacks," the article states, specifying that they include large-scale plots coordinated by the group's leaders, down to "isolated actions of self-radicalized people, who have absolutely no direct contact with ISIS, and yet who will consciously act in its name."
The same article says th e group's method for carrying out jihad in Europe involves an adaptation of Auftragstaktik, a combat doctrine within the German Army in the 19th century. Those tactical guidelines call for commanders to give subordinates a goal and a time frame in which to accomplish it, but otherwise to give them the freedom to execute it.
The Islamic State explains in the article that it adopted the system to give recruits "complete tactical autonomy," with few fingerprints that could be tracked back to the group, and "no micromanaging."
The Recruit PipelinePhoto The Paris neighborhood where Reda Hame lived. His French passport and information technology background made him an ideal recruit for the Islamic State's external operations branch. Credit Pierre Terdjman for The New York Times
By early 2015, the Islamic State's external operations branch had personnel dedicated to spending their days in Internet cafes in Syria pumping out propaganda, aimed both at inciting lone-wolf attacks and at luring new recruits.
Among the people who took the bait was Reda Hame, the young technology professional from Paris, who later told investigators that he had joined in hope of fighting to bring down President Bashar al-Assad of Syria. Instead, upon arriving in Syria in June 2015, he walked directly into the Islamic State's pipeline for foreign attacks.
During his intake interview in Raqqa, Syria, in June 2015, the Islamic State administrator taking notes on a computer across from him expressed satisfaction when he learned that Mr. Hame was from Paris and had a background in technology, according to his lengthy account to France's domestic intelligence agency, the Direction Générale de la Sécurité Intérieure, or D.G.S.I. The details were recorded in more than 16 hours of questioning, according to a transcript obtained by The Times and first reported on by the French newspaper Le Monde.
Days later, a man wearing a mask called Mr. Hame outside, told him to lie down in the bed of a pickup truck and covered him with a tarp. He was warned to keep his eyes lowered and not to look out.
They drove at high speed, and when the truck stopped, a fighter speaking Arabic directed him to a sport utility vehicle idling nearby, its tinted windows obscuring its occupants. When Mr. Hame opened the door to the back seat, the driver said, "Monte devant," French for "Get in the front."
The driver, Mr. Hame said, was Mr. Abaaoud, by then considered the most wanted terrorist in Europe. As they drove through the Syrian countryside, the future architect of the Paris attacks explained to Mr. Hame that if he faced the enemies of Islam alone, he would receive double the reward in heaven.
Graphic Brussels Is Latest Target in Islamic State's Assault on West
More than 650 Westerners have been killed in attacks carried out or inspired by the Islamic State.
"He asked me if I was interested in going abroad," Mr. Hame told investigators. "He said to imagine a rock concert in a European country — if you were given a weapon, would you be ready to open fire on the crowd?"
When Mr. Hame reiterated that he wanted to fight the Assad government instead, Mr. Abaaoud became terse. "He said he would show me those wounded in the war and buildings that had been destroyed, so that I would realize how lucky I was to be sent back to France rather than stay to fight here," Mr. Hame recounted.
Photo An Islamic State propaganda video showed one of the Paris attackers while he was still in Syria. In the footage, he is seen beheading a captive. Credit SITE Intelligence Group
Videos released by the Islamic State after the Paris attacks in November included footage of eight of the 10 attackers while they were still in territory the terrorist group controlled in Iraq and Syria. They announced that they were acting on the orders of Mr. Baghdadi, the caliph of the Islamic State, and then proceeded to shoot or behead a captive, most of them in grotesquely choreographed scenes shot against a desert backdrop, according to the footage archived by the SITE Intelligence Group.
Officials have deduced that the footage was filmed between February and September 2015, suggesting the Paris attacks were being planned months before they took place. It is now known that at the same time Mr. Abaaoud was laying the groundwork for the devastating plot, he was recruiting, cajoling and train ing Mr. Hame and others for smaller, quick-hit attacks.
The night they met, Mr. Abaaoud dropped off Mr. Hame at a house in Raqqa with a white gate, according to the transcript. He said he would come for Mr. Hame the next morning, and warned him that if he did not agree to the mission, his passport, which was about to expire, would be given to another recruit who would go to Europe in his place.
When Mr. Abaaoud returned the next day, his face was covered with a brown scarf with slits for his eyes. He wore a holstered handgun. "He told me that he was now going to explain the mission to me," Mr. Hame said after his arrest, describing how the discussion occurred in the senior operative's speeding vehicle. "He told me I didn't have a lot of time; he said he was just waiting for the confirmation of his emir. I told him that I would go. "
Accelerated TrainingPhoto One of the Paris attackers at target practice in Syria, in an Islamic State video. Mr. Hame's lack of skill with a Kalashnikov rifle angered Mr. Abaaoud, Mr. Hame told French investigators after his arrest. Credit Site Intelligence Group
Mr. Hame said his training began about a 30-minute drive from Raqqa, in a villa that acted as Mr. Abaaoud's classroom. There, the senior operative demonstrated how to load a Kalashnikov rifle. When Mr. Hame tried, he jammed his thumb in the metal, hurting himself. Mr. Abaaoud made him repeat the exercise again and again.
The next day, Mr. Abaaoud drove Mr. Hame to a park covered in dry grass for target practice. Throughout the lesson, Mr. Abaaoud repeatedly lost his temper, annoyed by his recruit's lack of skill.
"He yelled at me because when I was shooting in volleys, it went into the air," Mr. Hame recounted. "He made me practice a lot, to the point that the grass caught fire."
The instructor appeared even more on edge during the third and final day of Mr. Hame's military training, when he drew a silhouette on the wall of an abandoned building and demonstrated how to throw a grenade. Inexperienced and struggling in the suffocating heat, Mr. Hame did not throw it far enough and was cut by shrapnel. Only when Mr. Abaaoud saw him bleeding did he relent, driving his student to a nearby clinic to be bandaged.
At night, Mr. Hame was dropped off at an apartment in Raqqa that appeared to be a dormitory for members of the external operations branch. One room served as an arsenal, with stacks of suicide belts, jugs of explosives, body armor and combat boots. The other recruits were also French speakers, including a man who said he had been training for eight months. He and Mr. Hame were told to team up by Mr. Abaaoud, who decided to send them back to Europe the same day.
They were among the many pawns that Mr. Abaaoud was positioning across the Continent.
If Mr. Hame was not handy with weapons, he had other qualities that were attractive to the Islamic State: He had a French passport and had worked as a computer technician for Astrium, a subsidiary of the French aeronautics giant Airbus. It was at least the second time that Mr. Abaaoud had chosen a fighter with information technology credentials: Sid Ahmed Ghlam, who was dispatched last April to attack churches in France, was in the second year of a five-year computer science program, according to news reports.
The final phase of Mr. Hame's training took place at an Internet cafe in Raqqa, where an Islamic State computer specialist handed him a USB key. It contained CCleaner, a program used to erase a user's online history on a given computer, as well as TrueCrypt, an encryption program that was widely available at the time and that experts say has not yet been cracked.
The external operations unit was on a drive to improve its operational security after months of embarrassing failures.
Working on SecurityPhoto TrueCrypt, a basic encryption program used by Mr. Hame and other jihadists, was the first layer in a security protocol he was instructed to follow.
More than a year and a half earlier, the would-be Cannes bomber, Ibrahim Boudina, had tried to erase the previous three days of his search history, according to details in his court record, but the police were still able to recover it. They found that Mr. Boudina had been researching how to connect to the Internet via a secure tunnel and how to change his I.P. address.
Though he may have been aware of the risk of discovery, perhaps he was not worried enough.
Mr. Boudina had been sloppy enough to keep using his Facebook account, and his voluminous chat history allowed French officials to determine his allegiance to the Islamic State. Wiretaps of his friends and relatives, later detailed in French cour t records obtained by The Times and confirmed by security officials, further outlined his plot, which officials believe was going to target the annual carnival on the French Riviera.
Mr. Hame, in contrast, was given strict instructions on how to communicate. After he used TrueCrypt, he was to upload the encrypted message folder onto a Turkish commercial data storage site, from where it would be downloaded by his handler in Syria. He was told not to send it by email, most likely to avoid generating the metadata that records details like the point of origin and destination, even if the content of the missive is illegible. Mr. Hame described the website as "basically a dead inbox."
The ISIS technician told Mr. Hame one more thing: As soon as he made it back to Europe, he needed to buy a second USB key, and transfer the encryption program to it. USB keys are encoded with serial numbers, so the process was not unlike a robber switching getaway cars.
"He told me to copy what was on the key and then throw it away," Mr. Hame explained. "That's what I did when I reached Prague."
Mr. Abaaoud was also fixated on cellphone security. He jotted down the number of a Turkish phone that he said would be left in a building in Syria, but close enough to the border to catch the Turkish cell network, according to Mr. Hame's account. Mr. Abaaoud apparently figured investigators would be more likely to track calls from Europe to Syrian phone numbers, and might overlook calls to a Turkish one.
Next to the number, Mr. Abaaoud scribbled "Dad."
Photo Mr. Abaaoud rose through the ranks of the Islamic State's external operations efforts. Credit Agence France-Presse — Getty Images
Mr. Hame was instructed to make his way back to Paris, employing an itinerary that mimicked the journey of a backpacker on a summer holiday: He was to travel to Istanbul and spend a few days wandering the streets of the tourist district around Taksim Square.
Then he was to fly to Prague and buy a Czech SIM card. He would again check into a hotel, pretend to be a tourist and leave quick missed calls on Mr. Abaaoud's Turkish phone number. The record of the call would be Mr. Abaaoud's notification of his trainee's progress. Mr. Hame was expected to repeat the procedure for each leg of his journey, including in Amsterdam and then Brussels, before returning by train to Paris.
Once Islamic State leaders kne w that Mr. Hame had made it home, they would use the encryption and the Turkish drop box to coordinate further instructions, he said.
The mission began on the morning of June 12, when Mr. Abaaoud drove Mr. Hame and a second recruit to the Turkish border. Both had USB keys with TrueCrypt, and each was handed €2,000, in €500 bills, Mr. Hame said. Both had the same general agenda — to hit a soft target in Europe — but they were instructed to take separate paths, with Mr. Hame returning to France while the second recruit was headed to Spain.
But Mr. Hame's comrade was picked up after he flew to Spain, and under interrogation, he divulged Mr. Hame's plan as well. After being notified, the French police tracked Mr. Hame to his mother's apartment in Paris. Behind a couch, they found his USB stick from the Islamic State, and in his bag a piece of paper showing his login credentials for TrueCrypt. They arrested and began interrogating him last August, almost three months to the day before the worst terrorist attack in French history.
In many ways, it was another clear failure for the Islamic State's operational security. Mr. Hame agreed to cooperate with investigators, and confirmed that the group was bent on attacking in Europe and was already interested in picking out a concert hall to strike.
Yet many aspects of the group's security protocol were working. In the end, Mr. Hame had few specifics he could share with the authorities. He did not know the names or even the nationalities of the other operatives he had met; they had been introduced to him only by their aliases.
Two of Mr. Abaaoud's other small plots around the same time did not go any better. Sid Ahmed Ghlam was ordered by Mr. Abaaoud to open fire on a church in Villejuif, south of Paris, according to the report by France's antiterrorism police. Instead, he shot himself in the leg. Ayoub El Khazzani, the other attacker sent by Mr. Abaaoud, was tackled by passengers after his weapon jammed while he tried to open fire inside a high-speed Thalys train last August, officials said.
Though they failed, the thwarted plots kept counterterrorism officials stretched thin in the months before the November attacks in Paris.
"It served to put all of our agencies on edge," said France's chief antiterrorism judge, Marc Trévidic, who debriefed Mr. Hame, Mr. Ghlam and Mr. Khazzani before retiring last summer. "Just like a smoke screen, it allowed them to calmly prepare."
A Signature Explosive
Among the clearest signs of the Islamic State's growing capacity for terrorist attacks is its progress in making and deploying bombs containing triacetone triperoxide, or TATP.
The white explosi ve powder was found in the suicide belts of the Paris attackers and in the suitcases of the Brussels bombers, as well as in two other ISIS-led plots in 2014 and 2015.
Before ISIS, Al Qaeda repeatedly tried, but mostly failed, to deploy TATP bombs, starting in 2001 when Richard Reid tried to destroy an American Airlines flight by sneaking TATP onboard in the sole of his shoe. He was thwarted when the fuse failed to ignite.
TATP has become terrorists' go-to explosive in Europe because the main ingredients, acetone and hydrogen peroxide, can be found in common household goods like nail polish remover and hair bleach, experts say.
But while the building blocks are easy to come by, TATP is difficult to make, because t he ingredients are unstable once combined and can easily detonate if they are mishandled. Over at least two years, Islamic State operatives were working to get it right.
The three bombs found in Mr. Boudina's building near Cannes in 2014 were beverage cans filled with the explosive powder and wrapped in black tape, according to the French court filing in the case.
Though he had successfully cooked the explosive, Mr. Boudina was still struggling to set it off. He had jammed a filament into a cavity in the body of each can, most likely to use as a crude fuse, investigators concluded. However, the online searches he had conducted on his laptop just before his arrest indicated that he did not know how to make the final component. He searched "how to make a remote detonator," "detonation by cellphone," and finally "where to buy firecrackers?"
By comparison, the team sent from Syria to carry out the Paris assaults in November had ironed out the final details.
Two months before those attacks, the man suspected of handling logistics for the assailants , Salah Abdeslam, stopped by a fireworks shop northeast of Paris to buy a mechanism used to detonate fireworks from a distance, according to the French prosecutor. The Firework Magician shop's in-house lawyer, Frédéric Zajac, remembered little about the young man with a Belgian accent, except that "unlike other clients, he didn't ask questions about how it all worked."
Mr. Abdeslam is believed to be the only direct participant in the assaults to have survived, and he was arrested last week in Belgium after a continentwide manhunt.
The attackers he had been helping successfully detonated their suicide belts in seven locations in Paris, indicating that the group had mastered both how to mix the compound and how to set it off.
"To be able to assemble it safely, and to detonate it repeatedly, suggests a more organized effort," said Michael Marks, a retired Naval Criminal Investigative Service special agent who was the post-blast investigator on the Navy destroyer Cole. "It suggests a network."
That network stretched like a web across Europe to at least a dozen other accomplices, including a cell holed up in an apartment in the Brussels neighborhood of Schaerbeek, where two other teams of Islamic State fighters prepared the bombs detonated last week in Brussels Airport and a metro station.
The overpowering odor that comes with refining and storing TATP was noticed by the building's owner weeks before the bombings, Belgian officials said, but he did not report it until after the attacks.
While each of the explosive vests used in Paris in November had about a pound of finished TATP, the bombs used at the departure terminal of the airport and inside a subway car in Brussels are estimated to have weighed 30 to 60 pounds each, according to Claude Moniquet, a veteran of France's intelligence service who now heads the European Strategic Intelligence and Security Center.
That marked another level of achievement in making the explosive: The higher the volume of TATP, the more volatile it becomes.
The attacks last week could have been worse: Inside the attackers' apartment were more of the precursor ingredients used to make the explosive — nearly 40 gallons of acetone and eight gal lons of hydrogen peroxide — as well as a suitcase containing over 30 pounds of ready-to-go TATP, according to the Belgian police.
The one thing the attackers had not thought of was that the taxi they called to take them to the airport had room for only three suitcases, so they abandoned the fourth upstairs, Mr. Moniquet said.
Their taxi driver told the Belgian newspaper DH that the customers had refused to let him help them load the heavy bags, and that during the drive to the airport, they sat in tense silence.
The driver could not help but notice a strong odor wafting into the taxi from the sealed trunk.
Continue reading the main story
Source:
How ISIS Built the Machinery of Terror Under Europe's Gaze
S.Borisov/ShutterstockVenice is one of the best places to travel to alone, according to RoutePerfect.com.
Mazda's European boss, Jeff Guyton, says that the CX-9 might, for the first time, make it to the Old Continent. If it gets the green light, it will land with a diesel engine instead of the 250 HP 2.5-liter petrol unit that's available in the used on the US version.
