How Daesh Built the Machinery of Terror under Europe’s Gaze

Local Editor

For much of 2012 and 2013, the Takfiri group that eventually became Daesh [the Arabic acronym for the Takfiri "ISIS" group] was putting down roots in Syria. Even as the group began aggressively recruiting foreigners, especially Europeans, policy makers in the United States and Europe continued to see it as a lower-profile branch of al-Qaeda that was mostly interested in gaining and governing territory.

One of the first clues that Daesh was getting into the business of international terrorism came at 12:10 p.m. on Jan. 3, 2014, when the Greek police pulled over a taxi in the town of Orestiada, less than four miles from the Turkish border. Inside was a 23-year-old French citizen named Ibrahim Boudina, who was returning from Syria. In his luggage, the officers found 1,500 euros, or almost $1,700, and a French document titled "How to Make Artisanal Bombs in the Name of Allah."

But there was no warrant for his arrest in Europe, so the Greeks let him go, according to court records detailing the French investigation.

Boudina was already on France's watch list, part of a cell of 22 men radicalized at a mosque in the resort city of Cannes. When French officials were notified about the Greek traffic stop, they were already wiretapping his friends and relatives.

Several weeks later, Boudina's mother received a call from a number in Syria. Before hanging up, the unknown caller informed her that her son had been "sent on a mission," according to a partial transcript of the call.
Furthermore, in a utility closet in the same building, they found three Red Bull soda cans filled with 600 grams of TATP, the temperamental peroxide-based explosive that would later be used to deadly effect in Paris and Brussels.

It was not until nearly two years later, on Page 278 of a 359-page sealed court filing, that investigators revealed an important detail: Boudina's Facebook chats placed him in Syria in late 2013, at the scene of a major battle fought by a group calling itself Daesh.

According to a brief by France's domestic intelligence agency, he was the first European citizen known to have traveled to Syria, joined Daesh and returned with the aim of committing terrorism. Yet his ties to the group were buried in French paperwork and went unconnected to later cases.

At least 21 fighters trained by Daesh in Syria had been dispatched back to Europe with the intention of causing mass murder, according to a Times count based on records from France's domestic intelligence agency. The militants arrived in a steady trickle, returning alone or in pairs at the rate of one every two to three months throughout 2014 and the first part of 2015.

Like the killers in Paris and Brussels, all of these earlier operatives were French speakers - mostly French and Belgian citizens, alongside a handful of immigrants from former French colonies, including Morocco.

They were arrested in Italy, Spain, Belgium, France, Greece, Turkey and Lebanon with plans to attack businesses, police stations and a carnival parade. They tried to open fire on packed train cars and on church congregations. In their possession were box cutters and automatic weapons, walkie-talkies and disposable cellphones, as well as the chemicals to make TATP.
Most of them failed. And in each instance, officials failed to catch - or at least to flag to colleagues - the men's ties to the nascent Daesh.

Intelligence officials in the United States and Europe confirmed the broad outlines of the external operations unit: It is a distinct body inside Daesh, with its command-and-control structure answering to Adnani, who reports to Abu Bakr al-Baghdadi, the self-proclaimed caliph of Daesh.

The unit identifies recruits, provides training, hands out cash and arranges for the delivery of weapons once fighters are in position. Although the unit's main focus has been Europe, external attacks directed by Daesh or those acting in its name have been even more deadly beyond Europe's shores. At least 650 people had been killed in the group's attacks on sites popular with Westerners, including in Turkey, Egypt and Tunisia, according to a Times analysis.

Within the hierarchy, Abaaoud was specifically tasked with mounting attacks in Europe, according to the French police report and intelligence brief.

"Abaaoud, known as Abou Omar, was the principal commander of future attacks in Europe," Nicolas Moreau, a French Takfiri who was arrested last year, told his French interrogators, according to the report by France's anti-terror police. "He was in charge of vetting the applications of future candidates."

In an audio recording released on Sept. 22, 2014, Adnani, the Daesh spokesman and chief of the external operations wing, addressed the West.

"We will strike you in your homeland," he promised, calling on Muslims everywhere to kill Europeans, "especially the spiteful and filthy French." And he urged them to do it in any manner they could: "Smash his head with a rock, or slaughter him with a knife, or run him over with your car," he said, according to a translation provided by the SITE Intelligence Group, which monitors extremist propaganda.

In the months that followed, a man decapitated his employer near the French city of Lyon, sending a snapshot of the severed head to Daesh. Another man stormed a police station in Paris, carrying a butcher's knife and a photocopy of Daesh's flag.

These are among around two dozen plots linked to Daesh that were documented in the year after Adnani's speech. In most, there were no direct operational ties back to Syria, but there were clear signs that the attacker had consumed the terrorist group's propaganda online.
The low potency of these attacks, with single-digit death tolls, combined with the fact that many of the perpetrators had a history of mental illness, prompted analysts and officials to conclude that Daesh remained a distant second to al-Qaeda in its ability to carry out attacks on Western soil.

In a recent issue of its online magazine in French, Dar al-Islam, Daesh explained the approach. "The "Islamic State" has deployed its resources to generate three types of terrorist attacks," the article states, specifying that they include large-scale plots coordinated by the group's leaders, down to "isolated actions of self-radicalized people, who have absolutely no direct contact with Daesh, and yet who will consciously act in its name."

The same article said the group's method for carrying out terrorist attacks in Europe involves an adaptation of Auftragstaktik, a combat doctrine within the German Army in the 19th century. Those tactical guidelines call for commanders to give subordinates a goal and a time frame in which to accomplish it, but otherwise to give them the freedom to execute it.

Moreover, Daesh explained in the article that it adopted the system to give recruits "complete tactical autonomy," with few fingerprints that could be tracked back to the group, and "no micromanaging."

By early 2015, Daesh's external operations branch had personnel dedicated to spending their days in Internet cafes in Syria pumping out propaganda, aimed both at inciting lone-wolf attacks and at luring new recruits.

Among the people who took the bait was Reda Hame, the young technology professional from Paris, who later told investigators that he had joined in hope of fighting to bring down Syria's President Bashar al-Assad. Instead, upon arriving in Syria in June 2015, he walked directly into Daesh's pipeline for foreign attacks.

During his intake interview in Raqqa, Syria, in June 2015, Daesh administrator taking notes on a computer across from him expressed satisfaction when he learned that Hame was from Paris and had a background in technology, according to his lengthy account to France's domestic intelligence agency, the Direction Générale de la Sécurité Intérieure, or D.G.S.I. The details were recorded in more than 16 hours of questioning, according to a transcript obtained by The Times and first reported on by the French newspaper Le Monde.

Days later, a man wearing a mask called Hame outside, told him to lie down in the bed of a pickup truck and covered him with a tarp. He was warned to keep his eyes lowered and not to look out.

They drove at high speed, and when the truck stopped, a fighter speaking Arabic directed him to a sport utility vehicle idling nearby, its tinted windows obscuring its occupants. When Hame opened the door to the back seat, the driver said, "Monte devant," French for "Get in the front."

The driver, Hame said, was Abaaoud, by then considered the most wanted terrorist in Europe. As they drove through the Syrian countryside, the future architect of the Paris attacks explained to Hame that if he faced the enemies of Islam alone, he would receive double the reward in heaven.

The night they met, Abaaoud dropped off Hame at a house in Raqqa with a white gate, according to the transcript. He said he would come for Hame the next morning, and warned him that if he did not agree to the mission, his passport, which was about to expire, would be given to another recruit who would go to Europe in his place.
When Abaaoud returned the next day, his face was covered with a brown scarf with slits for his eyes. He wore a holstered handgun. "He told me that he was now going to explain the mission to me," Hame said after his arrest, describing how the discussion occurred in the senior operative's speeding vehicle. "He told me I didn't have a lot of time; he said he was just waiting for the confirmation of his emir. I told him that I would go."

Hame said his training began about a 30-minute drive from Raqqa, in a villa that acted as Abaaoud's classroom. There, the senior operative demonstrated how to load a Kalashnikov rifle. When Hame tried, he jammed his thumb in the metal, hurting himself. Abaaoud made him repeat the exercise again and again.

The next day, Abaaoud drove Hame to a park covered in dry grass for target practice. Throughout the lesson, Abaaoud repeatedly lost his temper, annoyed by his recruit's lack of skill.

"He yelled at me because when I was shooting in volleys, it went into the air," Hame recounted. "He made me practice a lot, to the point that the grass caught fire."

The instructor appeared even more on edge during the third and final day of Hame's military training, when he drew a silhouette on the wall of an abandoned building and demonstrated how to throw a grenade. Inexperienced and struggling in the suffocating heat, Hame did not throw it far enough and was cut by shrapnel. Only when Abaaoud saw him bleeding did he relent, driving his student to a nearby clinic to be bandaged.

At night, Hame was dropped off at an apartment in Raqqa that appeared to be a dormitory for members of the external operations branch. One room served as an arsenal, with stacks of suicide belts, jugs of explosives, body armor and combat boots. The other recruits were also French speakers, including a man who said he had been training for eight months. He and Hame were told to team up by Abaaoud, who decided to send them back to Europe the same day.

They were among the many pawns that Abaaoud was positioning across the Continent.

If Hame was not handy with weapons, he had other qualities that were attractive to Daesh: He had a French passport and had worked as a computer technician for Astrium, a subsidiary of the French aeronautics giant Airbus. It was at least the second time that Abaaoud had chosen a fighter with information technology credentials: Sid Ahmed Ghlam, who was dispatched last April to attack churches in France, was in the second year of a five-year computer science program, according to news reports.

The final phase of Hame's training took place at an Internet cafe in Raqqa, where aa Daesh computer specialist handed him a USB key. It contained CCleaner, a program used to erase a user's online history on a given computer, as well as TrueCrypt, an encryption program that was widely available at the time and that experts say has not yet been cracked.

The external operations unit was on a drive to improve its operational security after months of embarrassing failures.

The Daesh technician told Hame one more thing: As soon as he made it back to Europe, he needed to buy a second USB key, and transfer the encryption program to it. USB keys are encoded with serial numbers, so the process was not unlike a robber switching getaway cars.

"He told me to copy what was on the key and then throw it away," Hame explained. "That's what I did when I reached Prague."

Abaaoud was also fixated on cellphone security. He jotted down the number of a Turkish phone that he said would be left in a building in Syria, but close enough to the border to catch the Turkish cell network, according to Hame's account. Abaaoud apparently figured investigators would be more likely to track calls from Europe to Syrian phone numbers, and might overlook calls to a Turkish one.
Once Daesh leaders knew that Hame had made it home, they would use the encryption and the Turkish drop box to coordinate further instructions, he said.

The mission began on the morning of June 12, when Abaaoud drove Hame and a second recruit to the Turkish border. Both had USB keys with TrueCrypt, and each was handed €2,000, in €500 bills, Hame said. Both had the same general agenda - to hit a soft target in Europe - but they were instructed to take separate paths, with Hame returning to France while the second recruit was headed to Spain.

But Hame's comrade was picked up after he flew to Spain, and under interrogation, he divulged Hame's plan as well. After being notified, the French police tracked Hame to his mother's apartment in Paris. Behind a couch, they found his USB stick from Daesh, and in his bag a piece of paper showing his login credentials for TrueCrypt. They arrested and began interrogating him last August, almost three months to the day before the worst terrorist attack in French history.

In many ways, it was another clear failure for Daesh's operational security. Hame agreed to cooperate with investigators, and confirmed that the group was bent on attacking in Europe and was already interested in picking out a concert hall to strike.

Yet many aspects of the group's security protocol were working. In the end, Hame had few specifics he could share with the authorities. He did not know the names or even the nationalities of the other operatives he had met; they had been introduced to him only by their aliases.

Nonetheless, among the clearest signs of Daesh's growing capacity for terrorist attacks is its progress in making and deploying bombs containing triacetone triperoxide, or TATP.

The white explosive powder was found in the suicide belts of the Paris attackers and in the suitcases of the Brussels bombers, as well as in two other Daesh-led plots in 2014 and 2015.

Before Daesh, al-Qaeda repeatedly tried, but mostly failed, to deploy TATP bombs, starting in 2001 when Richard Reid tried to destroy an American Airlines flight by sneaking TATP onboard in the sole of his shoe. He was thwarted when the fuse failed to ignite.

TATP has become terrorists' go-to explosive in Europe because the main ingredients, acetone and hydrogen peroxide, can be found in common household goods like nail polish remover and hair bleach, experts say.

But while the building blocks are easy to come by, TATP is difficult to make, because the ingredients are unstable once combined and can easily detonate if they are mishandled. Over at least two years, Daesh operatives were working to get it right.

The three bombs found in Boudina's building near Cannes in 2014 were beverage cans filled with the explosive powder and wrapped in black tape, according to the French court filing in the case.

While each of the explosive vests used in Paris in November had about a pound of finished TATP, the bombs used at the departure terminal of the airport and inside a subway car in Brussels are estimated to have weighed 30 to 60 pounds each, according to Claude Moniquet, a veteran of France's intelligence service who now heads the European Strategic Intelligence and Security Center.

That marked another level of achievement in making the explosive: The higher the volume of TATP, the more volatile it becomes.

Source: NYT, Edited by website team