Investigators found crates’ worth of disposable cellphones, used and discarded after being meticulously scoured of email data. All around Paris, they found traces of consistent and improved bomb-making materials. And they began sketching in the details of a multilayered terrorist attack that evaded detection or prevention until much too late.
In the immediate aftermath of the Paris terror attacks on November 13th, French investigators came face to face with the reality that they had missed the signs that the Islamic State was able to mount large and sophisticated international terrorist strikes.
Now, the arrest on Friday of Salah Abdeslam, the man investigators believe was the attacks' logistics chief, offers a crucial opportunity to address the many unanswered questions surrounding how they were planned. Abdeslam, who was transferred on Saturday from a hospital to the Belgian federal police headquarters for questioning, is believed to be the only direct participant in the attacks who is still alive.
Much of what the authorities know is in a 55-page report compiled in the weeks after the attack by the French anti-terrorism police, presented privately to France's interior ministry; a copy was recently obtained by the New York Times. While much about the Paris attacks has been learned from witnesses and others, the report has helped investigators in recent months come to a deeper understanding of the sophisticated nature of the attacks.
Weaknesses exploited
Investigators have come to realise that the Paris attackers, sent by the Islamic State’s external operations wing, were well-versed in a range of terrorism tactics – like suicide vests, gunmen in various locations and hostage-taking – to hamper the police response, the report shows. They have exploited weaknesses in Europe’s border controls to slip in and out undetected, and worked with a high-quality forger in
Belgium
to acquire false documents.
The scale of the network that supported the attacks, which took 130 lives and wounded 813 people, has also surprised officials, as President François Hollande of France acknowledged on Friday. There are now 20 people in detention in six countries on suspicion of assisting the attackers.
French officials have repeatedly warned citizens that more attacks are possible, saying security and intelligence officials cannot track all the Europeans travelling to and from Islamic State strongholds in Syria and Iraq. And western intelligence officials say their working assumption is that additional Islamic State terrorism networks are already in Europe, with more being formed.
The French police report, together with hundreds of pages of interrogation and court records, suggest there are lingering questions about how many others were involved in the terrorist group’s network, how many bomb-makers were trained and sent from Syria, and the precise encryption and security procedures that allowed the attackers to evade detection during the three months they lay in wait before deploying to Paris.
The documents and interviews with officials show the arc of the Islamic State's growth from a group that was widely viewed as incapable of carrying out large-scale terror attacks. And they suggest that nearly two years of previous , failed attacks overseen by the leader of the Paris assault, Abdelhamid Abaaoud, served both as test runs and initial shots in a new wave of attacks the Islamic State leaders have called for in western Europe and Britain.
Night of carnage
Diners first saw the young man pacing back and forth in front of the bistro’s awning on Rue Voltaire. What drew their attention, they told investigators in accounts summarised in the police report to the French interior ministry, were the bulky layers of clothing he was wearing: an anorak on top of a coat with fur trim, over a vest that could be spotted through gaps in the clothing – excessive even for a chilly November evening.
Just after 9pm, he turned and abruptly walked into the bistro, past the covered terrace built around a curved bar. "He turned and looked at the people with a smile," the French police report said, offering previously unreleased details. "He apologised for any disturbance he had caused. And then he blew himself up." He turned out to be Ibrahim Abdeslam, a brother of the man arrested on Friday in Brussels, and his suicide bombing came near the start of a night of carnage that played out at cafes and restaurants, the national soccer stadium and a concert venue.
When the anti-criminal brigade of France’s national police arrived at the bistro, the Comptoir Voltaire, it found electrical wires in the bomber’s flesh. The wires were still attached to a white object, which in turn was next to a single alkaline nine-volt battery. Officials involved in the investigation say that the residue from the explosive used in the bistro tested positive for a peroxide-based explosive, triacetone triperoxide, or TATP. It has become the signature explosive for Islamic State operations in Europe, and it can be made with common products – hair bleach and nail polish remover – easily obtained over-the-counter across Europe.
In their investigation, the French police found traces of the same explosive formulation at each of the places in Paris where the attackers detonated their vests, including three times outside the stadium, Stade de France; once at the Comptoir Voltaire bistro; twice inside the Bataclan concert hall; and once in an apartment in a Paris suburb. Traces were also found in a rented apartment in Belgium occupied by the attackers in the weeks before the assault, according to forensic evidence detailed in the report.
Bomb ingredients
The reason the terrorist group uses this particular explosive, experts say, is the availability of the ingredients. But creating an effective bomb can be tricky, and the success in setting off bomb after bomb is indicative of the group’s training and skill.
“Their ingredients, when combined, are highly unstable and can explode easily if mishandled,” Peter Bergen, director of the National Securities Studies Program at the New America Foundation, said during recent congressional testimony. “To make an effective TATP bomb requires real training, which suggests a relatively skilled bomb-maker was involved in the Paris plot, since the terrorists detonated several bombs. It also suggests that there was some kind of bomb factory that, as yet, appears to be undiscovered, because putting together such bombs requires some kind of dedicated space.”
Since late 2013, records show Islamic State fighters have been training to make and use TATP in Europe. The first aborted attempt was in February 2014, when Ibrahim Boudina, a French citizen who had trained in Syria with the group that was about to become the Islamic State, was arrested in the resort city of Cannes. In a utility closet on the landing of his family's apartment block, the police found three Red Bull soda cans filled with the white TATP powder.
Although he had successfully constructed the three bombs, at the time of his arrest he appeared to be struggling with how to set off the charge. In his court file, among several obtained by the New York Times, investigators said he had been conducting internet searches for "how to make a detonator".
Terrorist protocol
Nearly two years later, the Paris attackers had clearly progressed. The police report and officials briefed on the investigation noted the uniformity of the parts in the bombs, suggesting a consistent protocol for preparing them. At the scene of one suicide bombing, at a McDonald’s restaurant about 250 yards from the French national soccer stadium, the police bagged the bomber’s severed arm. The autopsy showed that a piece of string with a flap of adhesive tape at one end, believed to be the detonation cord, was wrapped around the limb. Along with TATP residue, they again found electrical wires, a nine-volt alkaline battery to drive the detonation, and pieces of metal, including bolts, that had been mounted on the suicide belt as projectiles.
Seeking to blend in with the soccer fans, another bomber had been wearing a tracksuit with the logo of the German soccer team Bayern Munich. His severed leg was found still inside the tracksuit and, next to him, again a piece of white string.
All the previous attacks by Islamic State fighters dispatched from Syria had relied on a single mode of operation: a shooting, an explosion or an attempted hostage-taking. In Paris, the attackers set off to do all three, realising that this way they could overwhelm the country’s emergency response.
The attacks marked a subtle shift in the Islamic State's external operations branch, which was first publicised in the group's French-language online magazine, Daral-Islam, last March. In the previous small-scale attacks, the Islamic State, much like al-Qaeda before it, had taken aim at symbolic targets, including police and military installations and establishments with clear links to Israel or Jewish interests, like the Jewish Museum in Brussels. But in an interview published in the online magazine, a senior operative for the Islamic State, described as the godfather of French jihadis, advised his followers to abandon the symbolism.
“My advice is to stop looking for specific targets. Hit everyone and everything,” he said. The attackers in Paris appear to have moved easily between Belgium and France, and in some cases between the Middle East and Europe. Many European officials since have pointed to gaping vulnerabilities to the strategy pursued by the Islamic State. At least three of the Paris attackers were wanted on international arrest warrants before the attacks but were able to travel freely. And security services are constrained by the inability or unwillingness of countries to share intelligence about potential terrorists, for legal, practical and territorial reasons.
General targets
“We don’t share information,” said
Alain Chouet
, a former head of French intelligence, “We even didn’t agree on the translations of people’s names that are in Arabic or Cyrillic, so if someone comes into Europe through
Estonia
or
Denmark
, maybe that’s not how we register them in France or
Spain
. ”
The attackers also appeared to have studied how to exploit the limited capacity of local law enforcement. In Paris, the Islamic State for the first time pulled off a co-ordinated attack specifically designed to spread the authorities thin. The French police were already overwhelmed by the explosions at the stadium and the beginning of the cafe shootings by the time the terrorists attacked the Bataclan concert hall and took hundreds of people hostage. The police report offered extensive details about the siege, as recounted by those who survived it.
The headlining band had just started its set at the Bataclan when witnesses described first noticing a Volkswagen Polo with a Belgian licence plate approaching the hall, around 9.40pm, the report said. A security guard at the main entrance told the police that he had seen people falling around him, and that his reflex was to herd as many people as possible off the street and into the concert hall. He told the investigators that he had gone to the main concert area and began directing the panicked concert-goers toward the emergency exits, next to one of the bathrooms.
Before they could get that far, two of the gunmen pushed their way into the main hall, opening fire on the crowd as people hit the ground, lying flat on their stomachs. Those who managed to make it to the emergency exit threw it open, only to come face to face with the third gunman, who was waiting outside. One of the cellphones used by the attackers contained archived images of the Bataclan’s layout, suggesting they had planned their trap carefully, the police report said.
Through the emergency exit, the third and final gunman shot his way in. By then, the report said, people were shoving themselves into every space they could find. One group found refuge in a room used to store sound equipment. Others made it on to the roof. A few sprinted behind the attacker’s backs, managing to slip out.
Human shields
One hostage identified in the police report, David Fritz Goeppinger, who confirmed the account in a telephone interview, described how the gunmen had instructed the captives to sit in front of the closed doors “as human shields”, he said. “We were their protection in case someone tried to shoot from outside,” he said in the interview, confirming the report’s account that one hostage was forced to sit with his ear to the main entrance and was told to give updates on what he heard outside.
The attackers seized cellphones from the hostages and tried to use them to get on to the internet, but data reception was not functioning, Goeppinger told the police. Their use of hostages’ phones is one of the many details, revealed in the police investigation, pointing to how the Islamic State had refined its tradecraft. Court records and public accounts have detailed how earlier operatives sent to Europe in 2014 and early 2015 made phone calls or sent unencrypted messages that were intercepted, allowing the police to track and disrupt their plots. But the three teams in Paris were comparatively disciplined. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims.
According to the police report and interviews with officials, none of the attackers’ emails or other electronic communications have been found, prompting the authorities to conclude that the group used encryption. What kind of encryption remains unknown, and is among the details that Abdeslam’s capture could help reveal.
Hostages’ phones
Using their hostages’ phones, the attackers attempted to reach police, but were initially frustrated by the “Press 1” or “Press 2” menu of options, said a 40-year-old woman whose phone was used by the gunmen, and who was interviewed on Saturday. She spoke on the condition of anonymity because she did not want to draw attention to her ordeal.
After numerous delays, one of the attackers began using a hostage’s cellphone to send text messages to a contact outside. At one point one of the gunman turned to a second and said in fluent French, “I haven’t got any news yet,” suggesting they were waiting for an update from an accomplice in another location. Then they switched and continued the discussion in Arabic, according to the police report.
At nearly midnight, two hours after they took over the Bataclan, the gunmen began negotiating in earnest with the police. “We want to talk to someone!” the gunman demanded, then turned to his demands for France to stop military strikes in Syria: “I want you to leave the country. I want you to remove your military. I want a piece of paper signed that proves it!” If not, he threatened, “I’m killing a hostage and throwing him out the window!”
Potential encryption
One of the gunmen pulled out a laptop, propping it open against the wall, said the 40-year-old woman. When the laptop powered on, she saw a line of gibberish across the screen: “It was bizarre – he was looking at a bunch of lines, like lines of code. There was no image, no internet,” she said. Her description matches the look of certain encryption software, which Isis claims to have used during the Paris attacks.
The tallest of the three attackers was 6ft 2in tall. He had an explosive belt strapped on to his body and held a detonator in his hand. At one point, he stepped into the orchestra pit and started playing the xylophone, the whole time “laughing sadistically”, according to witnesses quoted in the report.
They would identity him later from his mug shot: he was Samy Amimour, a former bus driver.
France’s anti-criminal brigade was the first law-enforcement team to break through the Bataclan’s doors. The division commander, Guillaume Cardy, and a colleague got in through the main doors and managed to shoot one of the attackers, who was on the stage. Wounded, he detonated his explosive vest, the report said.
The two remaining gunmen returned fire, forcing Cardy to take cover. Members of another Paris police division tried to reach the wounded hostages, but were also forced to take cover, the report said. Together the police charged the two surviving gunmen and, after a heavy barrage of fire, they killed the second before he could detonate his vest. The third gunman then blew himself up. In the end, it took four elite brigades to stop three gunmen, the report said.
As the bodies of the dead were being bagged, the police found a white Samsung phone in a bin outside the Bataclan. Inside was a Belgian SIM card that had been in use only since the day before the attack. The phone had called just one other number – belonging to an unidentified user in Belgium. Another new detail from the report showed that in the phone’s photo album police found images of the concert hall’s layout, as well as internet searches for “fnacspectacles.com” a website that sells concert tickets, as well as “bataclan.fr” and the phrase “Eagles of Death at the Bataclan”.
Logistical master
The phone’s GPS data led investigators eight miles south of the concert hall to a budget hotel in the Paris suburb of Alfortville. The address was that of a budget hotel known as Appart’City, which has a pilled, blue carpet running down halls lit with panels of fluorescent bulbs. Two studios were reserved in the name of Salah Abdeslam, the suspect who was arrested on Friday. Along with his brother, Ibrahim Abdeslam, investigators say, he appears to have been in charge of logistics for the group.
Everywhere they went, the attackers left behind their throwaway phones, including in Bobigny, at a villa rented in the name of Ibrahim Abdeslam. When the brigade charged with sweeping the location arrived, it found two unused cellphones still inside their boxes.
New phones linked to the assailants at the stadium and the restaurant also showed calls to Belgium in the hours and minutes before the attacks, suggesting a rear base manned by a web of still unidentified accomplices. Security camera footage showed Bilal Hadfi, the youngest of the assailants, as he paced outside the stadium, talking on a cellphone. The phone was activated less than an hour before he detonated his vest. From 8.41pm until just before he died at 9.28pm, the phone was in constant touch with a phone inside the rental car being driven by Abaaoud. It also repeatedly called a cellphone in Belgium.
Most striking is what was not found on the phones: not a single email or online chat from the attackers has surfaced so far. Even though one of the disposable phones was found to have had a Gmail account, with the username “yjeanyves1”, the police discovered it was empty, with no messages in the sent or draft folders. It had been created on the afternoon of the attacks from inside the Appart’ budget hotel.
Crouton DNA
DNA swabs taken at the villa, including on a crouton left behind, helped the authorities determine that at least one of the stadium bombers had stayed there, as had Salah Abdeslam. The other objects found there suggest it may have been one of the locations where the bomb was assembled, including a piece of cloth identical to one found on the remains of one of the bombers, a roll of the same kind of adhesive tape used on the devices, and two pyrotechnic mechanisms.
As France was plunged into a state of emergency on the night of the attack, the Islamic State’s external operations branch could claim that it had achieved all its goals. Abaaoud and Salah Abdeslam were still alive. But perhaps that was not part of the plan, because it was then that mistakes appeared, the police report shows.
Abaaoud’s rental car was last spotted leaving Paris for an eastern, industrial suburb. The car was abandoned near the Croix de Chavaux station at about 10pm. Ten minutes later, a security camera captured footage of two men walking nearby, including one in orange sneakers. During the attacks, the report showed, witnesses and video cameras again and again described orange shoes on an attacker who was identifiable as Abaaoud.
Starting around that time, police records show that a 26-year-old woman, Hasna Aitboulahcen, began receiving phone calls on her Paris number from callers in Belgium. She was Abaaoud’s first cousin, according to a close friend who was later questioned by the police and who later talked to French news outlets. At one point, she had been engaged to him and remained smitten with him.
On November 15th, she and a friend drove to a ring road near the A86 freeway and parked. Abaaoud came out of the bushes and joined them, the report said, quoting the account of the friend. According to the friend’s account to the police, Abaaoud regaled them with stories about how he had made it to Europe by inserting himself in the stream of migrants fleeing across the Mediterranean. He explained that he was among 90 terrorists who had made it back and who had gone to ground in the French countryside, the friend told the police.
Kamikazes-in-waiting
“Abaaoud clearly presented himself as the commander of these 90 kamikazes-in-waiting, and that he had come directly to France to avoid the failures they had experienced in the past,” the police said the friend had told them. Abaaoud would spend a total of four days and three nights camped in the bushes, while his cousin returned with cake and water. By the friend’s account, Abaaoud told Aitboulahcen that he and an associate would carry out further attacks. Aitboulahcen was sent to buy the men new suits and dress shoes, the report said, bought with the nearly €5,000 the Islamic State’s network had sent via Western Union and an informal money exchange network known as
hawala
.
On the night of November 17th, Aitboulahcen succeeded in securing an apartment in the Saint-Denis district of Paris, chosen because the landlord did not require receipts. Police raided the building early the next morning, with Abaaoud and his cousin inside. The thundering boom of an explosive vest was recorded by television news crews outside. Inside the police again found the ingredients used to make the TATP bombs including wires and a battery, wrapped in adhesive tape. In addition to other weapons, they found a Herstal pistol with an empty clip, smeared with Abaaoud's DNA, suggesting he had fought to the end.
His body was found on the building’s third floor, and mixed in with his flesh were ball bearings and fragments of plastic. His feet were still inside the orange sneakers. Inside the ruins, the police found several dozen boxes of unused cellphones still inside their wrappers. The phones were found throughout the rubble, including in the rooms and stairwell, while others were ejected during the blast, and fell down on to the street below.
New York Times
