The ISIS attacks on France and Belgium exposed weaknesses in Europe’s approach to borders and information sharing that counterterror officials had warned about for years. The vulnerabilities remain largely unaddressed.
By Sebastian Rotella, ProPublica.org
This story was co-published with Frontline.
In June of 2015, a Belgian ex-convict named Mohamed Abrini flew to Turkey, slipped across the border into Syria and reached the Islamic State’s capital in Raqqah, where he met up with a boyhood friend planning a devastating terror strike on Paris.
Nicknamed “Brioche” because he had worked in a bakery, Abrini was not a hardcore holy warrior like his brother, who had died in Syria fighting for ISIS the year before. But his jihadi friend, Abdelhamid Abaaoud, won him over. Abaaoud took Abrini to his brother’s grave and said France was to blame for his death, according to European counterterror officials. The French were in the coalition bombing ISIS, Abaaoud said. They had to pay.
“Abaaoud really worked Abrini psychologically,” a Belgian counterterror official said. “His main motivation for participating in all this was revenge. Not Islam. He doesn’t know Islam. He’s a criminal … a street punk.”
Abrini proved an able operative. He moved confidently across borders, returning from Syria via Britain to pick up cash for the plot, according to Belgian counterterror officials. Back in Brussels, he fended off police who questioned him about a tip that he had been in Syria. Then he set to work leading a group of young extremists who were preparing the logistics for a multi-pronged attack on Paris, officials say.
Intelligence about impending attacks prompted Belgian federal police to begin surveillance on Abrini in October. On November 11, a hidden police camera filmed him leaving his home to drive with the attack team to Paris, according to counterterror officials. But the investigators were not following him, so they did not realize he was working on a plot, or alert French officials to his movements.
Two days later, attackers killed 130 people in coordinated assaults on the Bataclan concert hall, restaurants and a soccer stadium. Nine of the attackers died, but Abrini and other suspected accomplices took refuge in Brussels, where they eluded capture for another four months.
Abrini became notorious in March when Belgian authorities released a grainy security camera image of three men wheeling bomb-laden suitcases into the Brussels airport. Two died in suicide blasts, but police say Abrini lost his nerve at the last moment, fleeing as the bombs went off.
A total of 32 people died at the airport and a subway station. And the world came to know Abrini as The Man in the Hat.
Investigators soon captured him and, as they reconstructed his movements, turned up missed clues that might have prevented a disaster. Such breakdowns inevitably emerge after almost every major terror attack.
But a close look by Frontline and ProPublica at the interconnected assaults on Paris and Brussels brings to light problems that go well beyond the failure to nab Abrini. It reveals a scale of dysfunction remarkable in the annals of modern counterterrorism.
Most of the attackers and their accused accomplices were residents of Europe and well-known to police in their homelands as extremists. Six were wanted on international arrest warrants for terrorism, one for evading parole. At least nine were on terrorist watch-lists. Two had even surfaced in a 2009 investigation in which suspects discussed a potential target in Paris: the very same concert hall where the attackers slaughtered dozens in November.
French firefighters are shown after the coordinated terrorist attacks in Paris in November 2015. (Lewis Joly/Sipa via AP)
Nonetheless, the suspects spent months roaming back and forth to Syria and across Europe to prepare the plot, repeatedly crossing borders and fending off police with seeming ease. At least 12 were stopped, questioned and even arrested during border crossings, checkpoint encounters and police inquiries — an excruciating series of lost opportunities.
In unusually candid interviews in recent months, present and former European counterterror officials acknowledged that ISIS exploited a litany of longtime security weaknesses that remain largely unaddressed. The vulnerabilities, they said, arise from core contradictions in the European Union, where internal borders have been abolished for travel and commerce but impede police and intelligence work.
“The flaws in the European system are multiple,” said Jean-Louis Bruguiere of France, who was a top counterterror judge for two decades. He said the Paris and Brussels attacks “should never have happened.”
“I don’t know what we are waiting for,” Bruguiere said. “Do we have to wait for hundreds of deaths?”
If political leaders do not create a more effective security system, European countries will curtail free movement across borders, critics warn. They cite Britain’s vote this year to leave the European Union as a harbinger.
“If European policy is unresponsive, we will be putting up barriers again,” Bruguiere said. “Nobody wants it, but we will not be able to do otherwise if we are incapable of protecting ourselves. And everyone will barricade themselves and Europe will no longer exist.”
In interviews, some on camera with Frontline, counterterror veterans in Europe and the United States outlined systemic problems they said they had warned political leaders about for years. (ProPublica granted some anonymity because they are not authorized to speak publicly or because of security concerns.) The list includes:
- Weak and uncoordinated enforcement of Europe’s international borders, a situation aggravated by the chaotic influx of refugees from Syria.
- Differences in laws and security cultures that hamper intelligence-sharing and law enforcement cooperation among nations.
- Fragmented and incomplete databases, and the lack of a universal database of terror suspects effectively used and supplied by all European nations.
- Short prison sentences for terrorism and violent crime that have freed ex-convicts to play prominent roles in the jihad.
- Limited resources and support for security forces in some nations, such as Belgium and Greece — a weakness that terrorists have studied and exploited.
“We are not an island, we are the European continent, and the enemy is at our doorstep,” said Marc Trevidic, who was France’s top counterterror magistrate until 2015. “He can come by sea, air, and land. That is the reality.”
Some causes of Europe’s vulnerability are difficult to address. Although their approaches are vastly different, nearly every European country has struggled for decades to integrate Muslim immigrants into the social and economic mainstream. The speed of the radicalization process in the internet era defies traditional law enforcement strategies. Ubiquitous encryption tools are a shield against spy agencies. ISIS has the resources and refuge of a quasi-state.
And Europe has some of the best counterterrorism agencies in the world. Still, the threat posed by ISIS and other militants could be substantially lessened with common-sense reforms and political will, European and U.S. officials say.
“How is it possible after so many years?” said Baltasar Garzon, a former top Spanish judge. “They hit us with exactly the same failings, the same errors and the same discoordination.”
An emblematic example: in 2014, a U.S. intelligence task force assembled a list of thousands of Europeans believed to have joined the jihad in Syria, according to Matthew Olsen, the former director of the National Counterterrorism Center. To this day, European counterparts do not have an equivalent resource, he said.
“We had a relatively strong, robust data base of information within the United States, but [that] was a better source of information that the European nations themselves had or were sharing with each other,” Olsen said.
Europe has no equivalent of the FBI, so the security forces of each nation are responsible for fighting terror groups. Today, political leaders are trying to beef up institutions such as Europol, which attempts to coordinate law enforcement and information-sharing among the 28 member states.
“There is a strong consensus,” said Rob Wainright, the director of Europol. “We have to work much more together in the cross-border way. And that includes sharing intelligence as well as understanding the need to pass new European laws.”
More than a dozen of the suspects in the Paris and Brussels attacks came from Belgium, which served as a staging ground for the accused plotters. Leaders of other European nations have criticized the counterterror efforts of Belgium, a linguistically and culturally divided country where French and Flemish-speaking regions often clash about basic government functions.
Belgium’s woes are symptomatic of an approach to security that exists in other nations, especially in northern Europe, that emphasizes privacy and individual rights. However well-intentioned, the result has been to constrain law enforcement, critics say.
“Since the ’90s, Belgium has been an outpost for terrorists,” said Louis Caprioli, a former counterterror chief of France’s domestic intelligence agency. “The difficulty with Belgium is that it is a federal state, with services lacking human and technical resources, and which have very restrictive laws regarding wiretaps, the use of cameras, so they are in a dimension that is insufficient to face the extent of the phenomenon.”
Entrenched networks in Belgium figured in terror campaigns by Algerian groups in France in the 1990s, and al-Qaida activity in the decade after Sept. 11, when bombings killed 191 people in Madrid in 2004 and 52 in London in 2005.
But Belgium itself was not attacked and France didn’t experience a deadly Islamic terror attack between 1996 and 2012. As al-Qaida lost ground in its haven in Pakistan, European security chiefs felt the threat had become manageable.
The outbreak of civil war in Syria in 2012 transformed the landscape. The self-declared caliphate lured record numbers of militants, including at least 5,000 Europeans. Thousands more were radicalized at home by the Islamic State’s slick online propaganda machine.
The level of the threat varied. It was most intense in nations with restive second and third generations of young Muslims. As many as 500 jihadis from Belgium went to Syria — the highest proportional number in Western Europe. Belgium’s political leadership was slow to react. And it had a history of neglect of the security forces, critics say.
Belgium’s understaffed federal police and prosecution service hurried to more than double the size of their counterterror units in the past several years, officials say. The Belgian intelligence service wasn’t authorized to do wiretaps until 2008, and did not hire officers between 2010 and 2015, when 20 were belatedly brought on, according to Andre Jacob, a former counterterror chief of the spy agency.
“It was very frustrating,” Jacob said. Belgian political leaders “never had a long-term vision of how to fight against Islamic terrorism.”
Although it lacked tools and resources, Jacob’s intelligence service worked hard to monitor the tough, predominantly immigrant neighborhood of Molenbeek, where Abaaoud, Abrini and other key plotters of the Paris attacks grew up. It’s a difficult task. Long a port of entry for immigrants to Belgium, Molenbeek suffers from high unemployment, particularly among young people, and a sense of disconnection from Belgian society.
In this tight-knit world, many young people turn to violent crime. A friend of Abaaoud named Ibrahim Bakraoui was convicted of using an AK–47 to shoot and wound a police officer in a robbery in downtown Brussels in 2010. Bakraoui served only four years, and he turned radical after his release.
Abaaoud, similarly, was a leader of a neighborhood criminal network that radicalized. The young men embodied a phenomenon that ISIS has accelerated: the blurring of criminality and terrorism. They often retained a gangster lifestyle, making it harder for law enforcement officials to detect their ties to terrorism.
Although Belgian investigators who tracked them were skilled and experienced, the bureaucracy seemed sometimes oblivious to the new threat. In 2014, federal counterterror police had to fend off a proposal that would have barred them from carrying guns off duty. Alain Grignard, a senior officer, warned his superiors that it was the worst possible time to disarm investigators.
Alain Grignard, a senior counterterror official of the Belgian federal police. (Frontline)
“It was rather inappropriate because it was exactly at the moment when we feared things could happen,” said Grignard, who speaks Arabic and is an academic expert on Islam.
France has a more muscular security apparatus than Belgium. But because the court system is overloaded, French militants charged with terrorism frequently stand trial alongside robbers and drug dealers in low-level courts where the maximum sentence is 10 years. It is routine in France, Belgium and elsewhere to be released after serving just half the sentence.
As a result, Europeans previously convicted of aiding or fighting for terrorist groups have resurfaced recently. They have become leaders overseas such as Boubaker el Hakim, a prominent Frenchman in the Islamic State who served seven years for fighting for al-Qaida in Iraq in the mid–2000s. Or they have committed attacks such as the vicious murder this summer outside Paris of two police officials, a husband and wife, by an ex-convict who had served two and a half years for recruiting jihadis to go to Pakistan and Afghanistan.
They would probably still be in prison in the United States. In U.S. federal courts, such terrorism-related crimes bring a minimum of 15 years, and often much harsher sentences, according to Olsen, the former director of the National Counterterrorism Center.
“The important thing there is, 15 years for somebody who’s in their mid–20s or their 30s, that brings them into their 40s or mid–40s,” he said. “And the hope is that by the time they’re released, they’re not interested or too old to really be involved.”
European law enforcement officials worry about convicted terrorists released after relatively brief sentences returning to the fray. But they also caution against overreacting.
“Our system works for a lot of other people who are freed after one third or one half of their sentence,” said Eric Van der Sypt, a Belgian counterterror prosecutor. “So we have to punish those people because there are exceptions? Americans don’t like to hear that, the easiest way is to put them away for a hundred years, [but] then you have other problems … No system is perfect.”
It was cheap, fast and easy to join the jihad in Syria — and to bring it back home.
The thousands of young people with European passports who flocked to Syria included Abaaoud. He arrived in 2013, followed by friends from Belgium, and soon became influential among foreign fighters.
In May of 2014, a 29-year old Frenchman of Moroccan origin opened fire on the Jewish Museum of Brussels, killing four people. His name was Mehdi Nemmouche.
Nemmouche’s name was on a terror watch list. But he took advantage of a gaping hole in Europe’s security procedures, one that counterterror officials had been warning about for years.
Nemmouche spent nine months in Syria, where he harshly treated Western hostages, officials say. When he returned to Europe in March of 2014, he covered his tracks by booking flights that took him from Turkey to Asia to Germany.
At the Frankfurt airport, German officials spotted a French alert on him in their data base. But they did not have access to his full travel history or much time to scrutinize him. They informed the French that a suspected jihadi had returned to Europe only after he had left the airport, officials say.
The outcome would likely have been different had Nemmouche flown to New York City, according to European and U.S. security officials. After the 9/11 attacks, the United States adopted a system known as Passenger Name Record, or PNR, in which airlines provide personal data on people preparing to board flights to the U.S. Department of Homeland Security.
Under the system, counterterror officials gain 72-hours advance access to passengers’ full itineraries, phone numbers, addresses, emails, credit card numbers, past trips and travel companions. Analysts look for connections to crime and terrorism and for telltale patterns, such as roundabout travel to conceal stops in terrorist havens. PNR is credited with helping identify terrorists such as David Coleman Headley, an American convicted in the 2008 Mumbai attacks.
“We know people are coming from certain countries of concern and we have a single system geared to determining who they are before and during their trip to the U.S.,” a former FBI counterterrorism chief said. “We have a counterterrorism center where every federal agency is represented. When they get a hit, we at the FBI know before they travel that these guys are on their way. We have time to prepare for them, question them, examine their contacts in the U.S., conduct surveillance if necessary.”
European security chiefs had been pushing since 2007 for the European Union to adopt a comparable system. But until recently, legislators in the European Parliament repeatedly blocked the proposals, saying they threaten citizens’ privacy.
Rob Wainwright, director of Europol. (Frontline)
This impasse reflects fundamental disagreements between Europe and the United States over how to balance security and privacy, according to Wainright of Europol. Wainright compared the chasm to America and Europe’s sharp differences on gun control. He said EU policies have been shaped by the memory in countries such as Germany of authoritarian abuses of the Nazis and, later, the Stasi secret police.
“We have maybe a different privacy mindset,” Wainright explained. “Whenever legislation is debated which involves the further collection of personal data, I think lawmakers in many countries and the European Parliament will want to be convinced it’s absolutely necessary to do so, to fight terrorism or other forms of crime.”
Security officials respond that PNR consists of data that airlines already have. If the systematic screening had been in place in 2014, it is likely German officials would have suspected that Nemmouche had returned from Syria, flagged him as a suspicious traveler, and informed the French ahead of time, European and U.S. officials say. This would have probably prompted investigators to put him under surveillance upon arrival, according to Caprioli, the former French counterterror chief.
“I feel that the European legislators are responsible” for failing to prevent the Jewish Museum attack, Caprioli said. “If there had been a PNR, and if it had been well implemented by the services, this person would have been controlled … It is a flaw of our surveillance system of people circulating in Europe.”
Of course, no screening system is infallible, and French intelligence has itself been criticized for not tracking Nemmouche more closely. Regardless, European and U.S. officials say PNR would have improved the chances of stopping him and other terrorists in high-profile cases in Europe.
After Nemmouche’s arrest, investigators traced his movements and contacts. One name quickly surfaced: Nemmouche had communicated by phone with Abaaoud. Investigators believe the Belgian played a role in directing the Jewish Museum attack.
In August of 2014, the United States, France and other nations began bombing the Islamic State in an effort to roll back battlefield gains that had propelled its forces to the outskirts of Baghdad. This spurred European fighters in Syria to strike back.
“ISIS developed a logic of revenge, which intensified along with the bombardments,” Grignard said. “This meant that the people who wanted to launch actions in Europe gained in authority.”
Soon, Abaaoud again exploited weak border security — this time in person. Although wanted on an international arrest warrant, he managed to sneak back to Europe to direct a group of known Belgian extremists intent on an attack.
Abaaoud oversaw the plot by phone from Greece, and may have ventured into Belgium. His gunmen holed up in a safe house in the Belgian town of Verviers with guns, explosives and police uniforms. Investigators believe they were planning to target police officers, possibly to decapitate them and videotape the beheadings.
With help from U.S. and French intelligence, Belgian security forces had tracked the suspects. On Jan. 15, 2015, commandos stormed the safe house in Verviers, killing two combat-hardened militants and capturing one. Abaaoud fled back to Syria, eluding Greek police who raided his hideout in Athens.
That spring, Abaaoud and the other plotters launched a wave of rapidly trained recruits in solo attacks and foiled plots on France. Intelligence officials estimate that ISIS dispatched as many as 200 operatives during the year and a half before the Paris attacks.
Because many of the operatives were known or wanted, they entered Europe illegally, hiring smugglers to sneak them across the borders of Greece. Others flew from Turkey carrying genuine European passports of people who resembled them, or traveled with forged documents.
“It is very easy to travel in the European Union with fake papers, even in airports, usually you can get through controls,” said Van der Sypt, the Belgian counterterror prosecutor.
European and U.S. security chiefs have complained about the woeful state of EU border control for years. A commander of the counterterror division of the Spanish police described borders as “our Achilles heel.”
Continental Europe eliminated most internal borders in 1995. Driving from France to Belgium is like crossing from Illinois to Indiana. The security of the European Union therefore depends heavily on external land, air and sea boundaries. But resources, skills and enthusiasm vary among nations, and there has been a lack of coordination by the EU, critics say.
“We no longer have internal borders, so we need impenetrable external ones,” said Trevidic of France. “The means have never been provided to achieve this … We are in a totally open system. They can use real papers, real fake papers, fake fake papers, real real papers. It is horrible, but that’s the way it is.”
During the summer, the Islamic State advanced the most ambitious project yet: a spectacular strike in Paris. The plot moved with more speed and agility than the often-ponderous machinery in which security information circulates in the European Union.
Abaaoud served as a field coordinator. Investigators say he enlisted Abrini, his boyhood friend from Molenbeek, to act as the logistics chief in Europe.
After visiting Syria for about 10 days to get his marching orders, Abrini went to Britain from July 9 to July 16. He has said Abaaoud instructed him to obtain money from extremists in Birmingham and Manchester, according to counterterror officials. Abrini also took pictures of soccer stadiums and frequented casinos. The latter may have been for reconnaissance or for leisure, because he was an avid gambler, Belgian counterterror officials say.
From Britain, Abrini traveled to Paris for two days and returned home to Brussels, officials say. Meanwhile, police had been looking into a tip that he was involved in extremism and had gone to Syria. When he heard that, Abrini went to the Molenbeek police station to protest his innocence. Questioned on July 27, he denied everything. He showed officers photos from his travels, claiming he had been on vacation, Belgian officials say.
The police couldn’t prove their suspicions. The case remained technically open, but the file moved slowly from local to federal authorities, according to Belgian officials.
Unfazed by the police inquiry, Abrini allegedly set about his mission overseeing logistics. Officials say he worked closely with two accomplices who were on European extremist watchlists, Ahmed Dahmani and Salah Abdeslam.
Abdeslam, a close friend of Abaaoud, had been on the radar of police since the foiled Verviers plot. Dahmani was an ex-convict whose brother and sister had surfaced in the 2009 investigation of militants who had discussed attacking the Bataclan, according to French court documents.
In August, Abrini, Abdeslam and Dahmani got sloppy. They drove to Holland in a stolen Audi Quattro, likely on a trip to buy weapons, officials say. In Holland, all three made phone calls to a number linked to gangsters involved in arms trafficking, drug dealing and murder-for-hire, according to Belgian counterterror officials. When the trio returned to Belgium, the stolen car’s theft tracking system went off. Belgian police soon arrested Dahmani, officials say.
Dahmani was a suspected extremist with strong ties to Abaaoud’s crew. He had been in contact with arms traffickers in Holland. Weeks earlier, Italian authorities had registered his passage when he and Abdeslam had driven on another mission through Italy to Greece and back, a route used by extremists headed for Syria. And security video footage from a parking garage in Brussels showed him leaving the stolen car with Abrini.
Counterterror police questioned Dahmani and searched his home. They found an ISIS flag and propaganda, according to officials. But that alone wasn’t enough to prosecute him. The investigators opened a file on him as a possible extremist and released him, officials say. The dots were visible, but they hadn’t been connected.
Meanwhile, Europe was on increasingly high alert. Acting on another tip from U.S. intelligence, Polish authorities arrested a jihadi who was a resident of Spain and attempting to return from Syria via Warsaw. He admitted to Polish and Spanish interrogators that he had been sent by Abaaoud to attack Europe. And he gave up the name of a French accomplice, officials say.
French police scooped up the accomplice after he flew from Turkey to France. Questioned by Trevidic on Aug. 15, the suspect gave a chilling, detailed statement about the Islamic State’s plans. He said Abaaoud had directed him to await instructions for a mission that would involve shooting up a public place in France, such as a rock concert, according to Trevidic.
“He explained how much Abaaoud wanted to hurt us,” Trevidic recalled. “He was very clear: he will do whatever it takes. He wants to commit a huge attack at all costs.”
The capture was the result of effective international teamwork on a high-profile operation. But there were other moments in the run-up to the attack that showed the limits of routine cooperation.
In June, Turkish police arrested Bakraoui, the Belgian who had served time for shooting the police officer. The Turks suspected Bakraoui of trying to go to Syria to join ISIS, according to Belgian authorities. But Bakraoui convinced Turkish officials to deport him to Holland, where he had a relative, rather than his native Belgium.
The Turks didn’t tell the Dutch why they had put Bakraoui on a plane to the Netherlands, and didn’t identify him as a suspect to the Belgians until he was gone, according to European officials. But Bakraoui was wanted on a Belgian arrest warrant for failing to check in with his parole officer and violating the terms of his conditional release, according to Van der Sypt. The Dutch did not detain him when he arrived, so he walked freely back into Europe to resume his role in the attack planning.
Officials said the case illustrates the difficulties of cooperation among European neighbors — and of the European Union with Turkey, which has been a hub for the movement of jihadis and come under criticism for not cracking down on them sooner.
Bakraoui next surfaced in March of this year when Belgium released the photo of the three suicide attackers wheeling bombs into the Brussels airport. In the now-famous image, Bakraoui is the thickset man in a black sweater on Abrini’s right.
(Belgian Federal Police via AP)
International cooperation often depends on personal connections and the vagaries of national laws, according to Claudio Galzerano, the chief of an Italian counterterrorism unit based in Rome. An urgent Italian request might get a quick email response from Spanish police while requiring weeks of formal procedures in justice and foreign ministries in northern Europe, Galzerano said.
“Some countries face specific problems, often at a very basic level,” Galzerano said. “To obtain car registrations or telephone line registrations it is sometimes necessary to obtain a judicial order. You have to get that from the courts in order to run checks that in our country can be done directly by the police.”
As president of an EU working group of police officials, Galzerano learned about these complexities first-hand. He tried to assemble a list of fighters who had joined terror groups overseas. Some nations didn’t provide many names. Intelligence agencies were reluctant to give information to police forces, he said.
“There are countries that are more efficient than others … especially when dealing with foreign fighter investigations,” Galzerano said. “Europol has worked very hard to create databases capable of giving us good quality information on the foreign fighter situation. To date, not all countries have contributed to the same degree to these databases.”
Intelligence-sharing remains difficult because spy agencies still protect sources and methods, and still guard secrets, counterterror veterans said.
“These services’ traditional mission is to safeguard the interests of their country, not to exchange information with their neighbors,” said Italian Congressional deputy Stefano Dambruoso, a former counterterror prosecutor. “They are afraid that whatever information they release may then be exploited for other means … We still need to see a cultural change, a shift in different governments’ willingness to share their information.”
By late August, the next phase was underway.
A dozen members of the Paris attack squad began to leave Syria for Europe. They capitalized on the influx of hundreds of thousands of refugees, mostly Syrians fleeing the war, through Greece. The chaos only worsened the interconnected vulnerabilities of border defenses and intelligence-sharing.
Greek enforcement capacities, limited in the best of times, were overwhelmed by the wave of migration. Border guards were only able to conduct thorough screening — meaningful questioning, running fingerprint and database checks — on a third of the arrivals at most, according to European and U.S. security officials. On some islands, police didn’t even have consistent Internet access to process boatloads of migrants, officials say.
After being released in Greece, the hundreds of thousands of migrants and refugees headed across Eastern Europe in trains, vehicles and on foot, most of them bound for Germany, which had announced it would open its doors to Syrians fleeing the war.
“The refugee influx into one European country without centralized European border protection would be the equivalent of taking a small state like Arkansas and having them responsible for the entire border protection of the United States,” said Greg Ruppert, a former FBI attaché in Europe and veteran counterterror investigator.
At a time of a growing terror threat from Syria, security chiefs say Greece should have done more to vet the arrivals. But they also blame Europe’s political leaders for failing to help the Greeks screen a flood of refugees that would have overwhelmed any single country. For their part, political leaders focused on addressing a humanitarian catastrophe not seen in Europe since the end of World War II, not terrorism.
All this made it easy for ISIS to take advantage of the chaos. The vast majority of the border-crossers weren’t extremists, but they served as camouflage for the ones who were.
“Our borders are a disaster,” a senior French counterterror official said. “Add to that 1.5 million refugees crossing in a couple of years. It’s impossible to control, to screen, to enforce properly. Especially in Greece, with the state it’s in, the economic crisis, the lack of resources, the relatively low level of law enforcement capability. There is no doubt that ISIS infiltrated dozens of operatives, including the attackers for Paris and Brussels, through the refugee flow.”
The Belgian logistics team dispatched Abdeslam to Hungary several times to pick up plotters traveling among the refugees, officials say. Two of the Belgians and three of the Frenchmen he transported were wanted on international arrest warrants. Another Frenchman and Belgian were on watch lists. All crossed international borders unscathed.
So did Abaaoud, one of Europe’s most wanted men. Investigators believe migrant smugglers helped him enter through Greece in September.
Three conspirators had a close call, though. On Sept. 9, 2015, Abdeslam drove a rented Mercedes to a Budapest train station, which was jam-packed with refugees headed for Germany. He picked up two leaders of the attack team who had crossed into Greece in the refugee flow and were using crowds at the Budapest station as cover, officials say.
The new arrivals were Najim Laachraoui and Mohamed Belkaid. Laachraoui, a Belgian, was the bomb-maker. He was wanted on an international arrest warrant for terrorism issued by Belgium.
Belkaid was a coordinator of the plot. An Algerian who had lived in Sweden, he was an associate in Stockholm of Farid Lamrabet, the most notorious ideologue in Scandinavia, according to U.S. counterterror officials. Lamrabet had popped up in terrorism cases linked to Iraq, Pakistan and the United States. Swedish intelligence had been aware of Belkaid’s extremist ties for several years and shared that information with other countries, according to U.S. counterterror officials.
When the Mercedes carrying the trio arrived at the border of Austria, Austrian police stopped it at a checkpoint. Abdeslam handed over his identification papers, while Laachraoui and Belkaid showed forged Belgian identity cards with fake identities, European officials say.
Abdeslam was on an EU watch list. The national security alert in the Schengen Information System (SIS) called for officers to scrutinize him and any associates, record details and advise Belgian counterterror officials of the encounter.
It was another missed opportunity. If the border police had spotted the forged ID papers, the plot could well have been derailed, especially if they had identified Laachraoui and found the warrant for his arrest. But the police didn’t notice anything amiss, officials say, and the Mercedes sped toward Belgium. Belgian authorities only learned about the stop months later while investigating the Paris attacks, prosecutor Van der Sypt said.
The incident remains a mystery. Either the Austrian police officers didn’t find Abdeslam’s name in their databases, or they didn’t react aggressively to a watchlist hit, Belgian authorities say. But counterterror officers in other nations blame the Belgians, saying they should have given him higher priority on the watch list because of his ties to Abaaoud and other suspects.
Given the lack of procedures and systems, situations like the Austria border stop often come down to the attentiveness of the individual cop on the street. The chances of generating an investigation from such interactions, or even timely reports back to the suspect’s home country, are slim, European and U.S. officials say.
“Even if they got a hit, it only gets communicated to us by fax after a while,” the Belgian counterterror official said. “It’s not urgent unless the cop is especially smart or aggressive. And it might not make its way to the right unit of the Belgian counterterror police for weeks, if at all. And because one European police force doesn’t know that well the documents of another country, and the officers didn’t look very hard at the documents, they didn’t realize these guys were carrying fake Belgian IDs.”
The crazy-quilt of laws and intelligence cultures that leave EU databases fragmented and incomplete is a key weakness, officials acknowledged. There are no Europe-wide criteria for how the databases should be fed, according to European and U.S. security officials. As a result, the frequency with which agencies put names in data bases — and even consult the systems — differs considerably, officials say.
“We are dealing with a very complex environment, 20-plus countries, 2 million law enforcement officers in Europe, potentially having access to these sort of systems,” said Wainright, the Europol director. “And perhaps the greatest learning lesson, not dissimilar actually to the reflection the U.S. went through after 9/11, was that we need to join the dots a lot better than this and we need to have a much more systematic, better hooked-up, centralized system.”
On Sept. 20, another suspected plotter arrived on the Greek island of Leros. He posed as a Syrian refugee, but he was really a Swede of Syrian descent named Osama Krayem, Belgian authorities say. Krayem allegedly adopted the ruse because he knew Swedish police had identified him as an extremist before he had left to join ISIS. He felt confident enough to surrender to Greek authorities as an asylum-seeker. Sure enough, he was promptly released.
On Oct. 3, there was yet another close call. Four suspected operatives landed in Leros in a boatload of 198 people claiming to be Syrian refugees. Greek authorities made an effort to screen them, according to Wainright.
“The Greeks had every last detail of every person on that boat,” Wainright said. “So it kind of showed, to be fair to them, that they were documenting them, that there were security screening them, notwithstanding the huge challenges that they have. But we learned the lesson, we need to go further.”
Two of the men were later described in ISIS propaganda as Iraqi militants. They presented Syrian passports saying they were Ahmad Al-Mohammad and Mohammad Al-Mahmod. One of those passports would be found on November 13 outside the Stade de France stadium, where the duo blew themselves up with suicide bomb vests, according to European and U.S. authorities.
In April 2014, Interpol had recorded that passport in its data base as part of a batch of 1,452 stolen blank Syrian passports, according to Interpol officials. It was well-known that ISIS had stolen or acquired such passports en masse in its territory. Specialists then doctored them in laboratories for the use of Islamic State operatives.
The Interpol data base for stolen passports should have been an essential tool in the task of screening Syrian refugees. But Greek authorities were not regularly using it, according to European and U.S. counterterror officials. Both men were released, their fraudulent passports accepted as genuine.
Greek police did detain the two other alleged ISIS plotters. While questioning Adel Haddadi and Mohamed Usman Ghani, police realized the two had forged Syrian documents. Haddadi was Algerian and Ghani was Pakistani. Greek authorities held them for a few weeks as illegal immigrants, then released them with orders to leave the country.
Haddadi was known to Algerian and European authorities as an extremist, and Ghani was a former member of the Lashkar-e-Taiba terrorist group of Pakistan, according to U.S. counterterror officials. An investigation by police with counterterror expertise might have turned up that information. Surveillance after their release might have spotted their communications to ISIS bosses in Syria. Instead, the two made their way to Austria, and were arrested in December after the Paris attacks.
“We think ISIS excluded them from the [Paris] operation once they had been detained at the Greek border, fearing they might have been burned or followed,” the senior French counterterror official said. “Theoretically, if there had been a vigorous investigation when they were stopped at the border in Greece, they could have been discovered and traced back to the plot. But there are too many refugees. They were being screened by Greek border police, not antiterrorist police. So in the real world, given the situation at that border and of European law enforcement, it was unlikely.”
Soon, the attack squad convened at safe houses in Belgium procured by Abrini’s logistics crew. But they didn’t know the police were closing in on Abrini.
In October, an overworked counterterror squad of the Belgian federal police decided to revive the Abrini case file that had been sitting largely inactive since July. The alerts from France about imminent attacks caused the investigators to focus on associates of Abaaoud.
There weren’t resources for 24-hour physical surveillance, but investigators hid a camera outside Abrini’s home in Molenbeek. They also tried to monitor his phones, though the wiretaps didn’t produce much, according to Belgian counterterror officials.
In November, as the suspected plotters assembled bomb vests at the safe houses, Abrini was under active investigation. But the surveillance didn’t detect the plot.
On Nov. 11, two days before the attacks, the police camera hidden outside Abrini’s home filmed him getting into a car, probably driven by Abdeslam, according to Belgian counterterror officials. Abdeslam was also under investigation as a suspected extremist with ties to Abaaoud, though he was not being followed or wiretapped, Belgian officials say.
No one saw the two men join the attack squad, officials say. Abrini later told Belgian officials that the group drove with guns and explosives in a convoy to Paris, using a scout car, chase car and other tactics often employed by drug runners.
A gas station camera in France filmed Abrini and Abdeslam together that night.
“If we had had one or two weeks more to investigate, we could have maybe arrested them and prevented the Paris attacks,” the Belgian counterterror official said. “But you have to remember how many people we were watching.”
It was just the last link in a chain of missed opportunities, breakdowns and gaps that had stretched across a continent.
In the aftermath of the Paris attacks, French authorities complained that the Belgians should have cracked down harder on the Molenbeek crew and communicated more about the threat.
“It’s not by chance that the whole network was based in Belgium and not in France or Italy,” said Bruguiere, the former top French counterterror magistrate. “They chose a place that is both the weakest link, and where there were networks that existed for years”
The Belgians respond that there is plenty of dysfunction beyond their borders.
“It’s a bit too easy for all these big countries with a lot of police officers and foreign intelligence services to criticize Belgium,” said Grignard. “We’re a small country, we don’t have a police culture and we don’t have our own foreign intelligence service. It’s impossible to keep an eye on everyone.”
After Paris, Abrini and half a dozen other surviving suspects took refuge in safe houses in Brussels, protected by clan and criminal networks. They eluded a manhunt and the high-tech might of U.S. and British spy agencies, which were trying to detect their communications. During the next four months, the fugitives used encrypted messaging to communicate with leaders in Syria about a new plot.
In March, Belgian police finally closed in, killing Belkaid and capturing Abdeslam in raids. The remaining fugitives struck on March 22 at the Brussels airport and subway station. Three bombers blew themselves up. Both Abrini and Krayem, who was at the subway station, failed to detonate their bombs. Airport security camera footage shows Abrini pushing away his bomb-laden luggage trolley, ducking behind a pillar and fleeing, according to counterterror officials.
Police captured Abrini in April. In the interrogation room, the pale 31-year-old faced detectives across a table. A burly, ski-masked security officer sat near him. Belgian officials say Abrini wept.
“It feels like I’m waking up from a bad trip,” he said, according to the officials. “I didn’t know so many people were going to get hurt.”
Although military operations have hurt ISIS, intelligence officials warn that battlefield losses could generate retaliatory attacks — and violence from jihadis returning home.
Police in Germany, France, Belgium and other nations continue to dismantle plots. The workload, political pressure and media bombardment have left investigators exhausted and demoralized.
“Young colleagues, colleagues I have recruited, have seen more violence in two years than I have in 30,” Grignard said. “That is surreal. It is even possible, that in the end, these people will be afraid of working because they will be criticized for not having done something [on a case] a year ago, or six months ago, etcetera. And if no one wants to come and work for us, who will do the job?”
In response to Europe’s security crisis, political leaders have promised reforms. The EU has created a European Coast Guard and Border Agency. Europol has set up a counterterror center. After years of resistance, the European Parliament voted this spring to approve PNR airport screening. That system is not expected to be operational until 2018.
“There’s been a political realization about the gravity of the terrorist threat that we face,” Wainright said. European lawmakers “understood that we need to raise our defenses, raise our security game … There is still a way to go, I think, to get the right balance between privacy and security.”
Counterterror veterans warn that the structural problems persist, making Europe as vulnerable as ever.
“What I’m afraid of is that Europe will find itself dealing with attacks such as those seen in Paris and over the past year for a very long time,” said Dambruoso, the Italian congressional deputy. “Time is passing and we are no closer to finding substantial solutions.”