fbpx Skip to content
Menu

Paris to Brussels: how Islamic State is striking at the heart of Europe

Introduction
This report aims to tie together all the facts and connections between the Paris and Brussels attacks. We also highlight current information gaps, which we intend on updating as further information comes to light. The report also highlights areas where the Brussels attacks could have been interrupted or stopped completely. The final part of the report looks at the factors of radicalization, the channelling of grievances into terrorism, European societal cohesion and finally the rise of right wing groups as a response.
Paris Attacks
13th November 2015
130 people killed, 368 injured

Timeline of Attacks

Stade de France: 2120hrs â 2153 hrs
The first bomber, Bilal Hadfi attempted to enter the stadium, however as security patted him down they found his suicide vest. A few seconds after being turned away Hadfi detonated his vest, killing himself and a bystander. Investigators later surmised that the first suicide bomber had planned to detonate his vest within the stadium, triggering the crowdâs panicked exit onto the streets where two other bombers were lying in wait. Ten minutes after the first bombing, the second bomber blew himself up near the stadium. Another 23 minutes after that, the third bomberâs vest detonated nearby; according to some reports, that location was at a McDonaldâs restaurant; others state that the bomb detonated some distance away from any discernible target. Update: French police found traces of TATP. At the scene of one suicide bombing, at a McDonaldâs restaurant about 250 yards from the French national soccer stadium, the police bagged the bomberâs severed arm. The autopsy showed that a piece of string with a flap of adhesive tape at one end, believed to be the detonation cord, was wrapped around the limb. Along with TATP residue, they found electrical wires, a 9-volt battery to drive the detonation, and pieces of metal, including bolts, that had been mounted on the suicide belt as projectiles.Seeking to blend in with the soccer fans, another bomber had been wearing a tracksuit with the logo of the German soccer team Bayern Munich. His severed leg was found still in the tracksuit and, next to him, again, a piece of white string.

Location of Leros where both Ahmad al Mohammad and M al-Mahmod entered the European Union, suggesting their route was via Turkey.

10th/11th Arrondissments: 2125hrs â 2140hrs
The second team was composed of Brahim Abdeslam (brother of Salah Abdeslam), Chakib Akrouh and the ring leader of the Paris attacks, Abdelhamid Abaaoud. This team attacked bars and restaurants in the areas of the 10th and 11th Arrondissement. Brahim Abdeslam finally sat down at Comptoir Voltaire Brasserie and placed an order before blowing himself up. Akrouh and Abaaoud escaped the area, possibly to an apartment in Saint Denis where they would later be killed five days later. Update: Diners first saw the young man pacing back and forth in front of the bistroâs awning on Boulevard Voltaire. What drew their attention, they told investigators in accounts summarized in the police report, were the bulky layers of clothing he was wearing: an anorak on top of a coat with fur trim, over a vest that could be spotted through gaps in the clothing â excessive even for a chilly November evening. Just after 9 p.m., he turned and walked into the bistro, past the covered terrace built around a curved bar. â He turned and looked at the people with a smile,â the French police report said, offering previously unreleased details. âHe apologized for any disturbance he had caused. And then he blew himself up.âWhen the Anti-Criminal Brigade of Franceâs National Police arrived at the bistro, the Comptoir Voltaire, it found electrical wires in the bomberâs flesh. The wires were still attached to a white object, which in turn was next to a single alkaline 9-volt battery, elements of a detonation mechanism. Officials involved in the investigation say that the residue from the explosive used in the bistro tested positive for a peroxide-based explosive, triacetone triperoxide, or TATP.

Bataclan Theatre: 2140hrs â 0020hrs
The third team was composed of Omar Ismail Mostefai, Samy Amimour and Foued Mohamed Aggad. They attacked the Bataclan Theatre at 2140hrs, where the American band, Eagles of Death Metal were playing to an audience of about 1,500 people. An hour into the concert the three terrorists pulled up outside the venue with AKM assault rifles and entered the hall. The terrorists took up positions on the Mezzanine and began firing on the crowd. The attack lasted for 20 minutes and there were reports of the attacker throwing grenades into the crowd.
At 2200hrs, the attackers took 60-100 people hostage as police gathered outside the venue. The terrorists threatened to decapitate a hostage and throw the corpse out the window every five minutes. At 2215hrs, the Brigade of Research and Intervention arrived on the scene, followed by the elite tactical unit RAID. An assault on the theatre began at 0020hrs and lasted three minutes. It was launched because there were reports that the terrorists started killing hostages. 89 people were killed in total at the Bataclan Theatre. Two of the terrorists died by detonating their suicide vests, and another was hit by a police bullet and his vest blew up when he fell.
Update: The lone security guard posted at the concert hallâs main entrance told the police that he had seen people falling around him. He began herding people inside, off the street and directing the panicked concertgoers toward the emergency exits. Before they could get that far, two of the gunmen pushed their way into the main hall, opening fire on the crowd as people hit the ground, lying flat on their stomachs. Those who managed to make it to the emergency exit threw it open, only to come face to face with the third gunman, who was waiting outside.
One of the cellphones used by the attackers contained archived images of the Bataclanâs layout, suggesting they had planned their trap carefully, the police report said. Through the emergency exit, the third and final gunman shot his way in. The gunmen had instructed the captives to sit in front of the closed doors as human shields. The attackers seized cellphones from the hostages and tried to use them to get onto the Internet, but data reception was not functioning. Their use of hostagesâ phones is one of the many details, revealed in the police investigation, pointing to how the Islamic State had refined its tradecraft. Court records and public accounts have detailed how earlier operatives sent to Europe in 2014 and early 2015 made phone calls or sent unencrypted messages that were intercepted, allowing the police to track and disrupt their plots. But the three teams in Paris were comparatively disciplined. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims.
Using their hostagesâ phones, the attackers attempted to reach the police, but were initially frustrated by the âPress 1â or âPress 2â menu of options, said a 40-year-old woman whose phone was used by the gunmen, and who was interviewed on Saturday. She spoke on the condition of anonymity because she did not want to draw attention to her ordeal.
After numerous delays, one of the attackers began using a hostageâs cellphone to send text messages to a contact outside. At one point, one of the gunmen turned to a second and said in fluent French, âI havenât gotten any news yet,â suggesting they were waiting for an update from an accomplice. Then they switched and continued the discussion in Arabic, according to the police report.
At nearly midnight, two hours after they took over the Bataclan, the gunmen began negotiating in earnest with the police.
âWe want to talk to someone!â one gunman demanded, then turned to his demands for France to stop military strikes in Syria: âI want you to leave the country. I want you to remove your military. I want a piece of paper signed that proves it!â If not, he threatened, âIâm killing a hostage and throwing him out the window!â
One of the terrorists pulled out a laptop, propping it open against the wall, said the 40-year-old woman. When the laptop powered on, she saw a line of gibberish across the screen: âIt was bizarre â he was looking at a bunch of lines, like lines of code. There was no image, no Internet,â she said. Her description matches the look of certain encryption software, which ISIS claims to have used during the Paris attacks.
The tallest of the three attackers was 6 feet 2 inches tall. He had an explosive belt strapped to his body and held a detonator in his hand. At one point, he stepped into the orchestra pit and started playing the xylophone, the whole time âlaughing sadistically,â according to witnesses quoted in the report. They would identity him later from his mug shot: He was Samy Amimour, a former bus driver.

St Denis Raid
18th November 2015
In the early morning of 18 November 2015, French police, including RAID, backed up by military units, launched an offensive in Saint-Denis against a building presumed to be the location of alleged Paris attacks mastermind Abdelhamid Abaaoud. The target was a building at 8 rue du Corbillon, less than 2 kilometres north the Stade de France. Police located the house on 17 November 2015 following a tip from Morocco and then following a known associate of Abaaoud to 8 rue du Corbillon. On 18 November 2015 at 0420hrs, police launched an assault on the building. The initial offensive was repelled by the terrorists. Explosives laid by police at the entrance were ineffective as the door was armoured, allowing the militants inside time to arm themselves and respond. At 0720hrs, heavy gunfire erupted and multiple explosions, presumed to be police grenades, were heard by residents nearby. It was later reported that one of these explosions was a suicide bomber (Chakib Akrouh) who had lured police to the building in an attempt to draw them into blast range. The siege ended by 0820hrs, with nearly 5,000 rounds being fired by police. At least three militants, including a suicide bomber, were killed and eight were captured, seven of which were later released. The man who was kept in custody said he was in charge of the property. Five police were injured and a Belgian Shepherd police dog was killed in the raid. Islamic State claimed responsibility for the attacks, saying that it was retaliation for the French airstrikes on the group in Syria and Iraq.
Update:
Mr. Abaaoudâs rental car was last spotted leaving Paris for an industrial area in an eastern suburb. The car was abandoned near the Croix de Chavaux station about 10 p.m. Ten minutes later, a security camera captured footage of two men walking nearby, including one in orange sneakers. During the attacks, the report showed, witnesses and video cameras again and again described orange shoes on an attacker who was identifiable as Mr. Abaaoud. Starting around that time, police records show that a 26-year-old woman, Hasna Aitboulahcen, began receiving phone calls on her Paris number from callers in Belgium. She was Mr. Abaaoudâs first cousin, according to a close friend who was later questioned by the police and who later talked to French news outlets. Ms. Aitboulahcen was described as being smitten with him for years.
On Nov. 15, she and a friend drove out to a remote spot along the freeway, where Mr. Abaaoud came out of the bushes and joined them, the report said, quoting the account of the friend.
According to the friendâs account to the police, Mr. Abaaoud regaled them with stories about how he had made it to Europe by inserting himself in the stream of migrants fleeing across the Mediterranean. He explained that he was among 90 terrorists who had made it back and who had gone to ground in the French countryside, the friend told the police.
âAbaaoud clearly presented himself as the commander of these 90 kamikazes-in-waiting, and that he had come directly to France in order to avoid the failures they had experienced in the past,â the police said the friend had told them.
Mr. Abaaoud would spend four days and three nights camped in the bushes, while his cousin returned with cake and water. By the friendâs account, Mr. Abaaoud told Ms. Aitboulahcen that he and an associate would carry out further attacks. Ms. Aitboulahcen was sent to buy the men new suits and dress shoes, the report said, bought with the nearly 5,000 euros the Islamic Stateâs network had sent via Western Union and an informal money exchange network known as a hawala.
On the night of Nov. 17, Ms. Aitboulahcen secured an apartment in the Saint-Denis suburb of Paris, chosen because the landlord did not require receipts.
The police raided it early the next morning, with Mr. Abaaoud and his cousin inside. The thundering boom of an explosive vest was recorded by television news crews outside.
Inside, the police again found the components used to make the TATP bombs. In addition to other weapons, they found a Herstal pistol with an empty clip, smeared with Mr. Abaaoudâs DNA, suggesting that he had fought to the end.
His body was found on the buildingâs third floor, and mixed in with his flesh were ball bearings and fragments of plastic. His feet were still in the orange sneakers.
Inside the ruins, the police found several dozen boxes of unused cellphones still in their wrappers. The phones were found throughout the rubble, including in the rooms and stairwell. Others had been ejected during the blast and fell onto the street below.

Updates
Investigators found cratesâ worth of disposable cellphones.
The attackers, sent by the Islamic Stateâs external operations wing, were well versed in a range of terrorism tactics â including making suicide vests and staging coordinated bombings while others led shooting sprees â to hamper the police response.
As of Saturday 19th March 2016, there are 18 people in detention in six countries on suspicion of assisting the attackers.
To make an effective TATP bomb requires real training, which suggests a relatively skilled bomb-maker was involved in the Paris plot, since the terrorists detonated several bombs. It also suggests that there was some kind of bomb factory that, as yet, appears to be undiscovered, because putting together such bombs requires some kind of dedicated space.â
That night, the French police were already spread thin by the explosions at the stadium and the beginning of the cafe shootings by the time the terrorists attacked the Bataclan concert hall and took hundreds of people hostage.
As the bodies of the dead were being bagged, the police found a white Samsung phone in a trash can outside the Bataclan. The phoneâs GPS data led investigators eight miles south of the concert hall to the Paris suburb of Alfortville. The address was that of a hotel known as AppartâCity. Two studios were reserved in the name of Salah Abdeslam, the suspect who was arrested on Friday. Along with his brother Ibrahim Abdeslam, investigators say, he appears to have been in charge of logistics for the group.
Everywhere they went, the attackers left behind their throwaway phones, including in Bobigny, at a villa rented in the name of Ibrahim Abdeslam. When the brigade charged with sweeping the location arrived, it found two unused cellphones still inside their boxes.
New phones linked to the assailants at the stadium and the restaurant also showed calls to Belgium in the hours and minutes before the attacks, suggesting a rear base manned by a web of still unidentified accomplices.
Security camera footage showed Bilal Hadfi, the youngest of the assailants, as he paced outside the stadium, talking on a cellphone. The phone was activated less than an hour before he detonated his vest. From 8:41 p.m. until just before he died at 9:28 p.m., the phone was in constant touch with a phone inside the rental car being driven by Mr. Abaaoud. It also repeatedly called a cellphone in Belgium.
DNA swabs taken at the villa, including on a crouton left behind, helped the authorities determine that at least one of the soccer stadium bombers had stayed there, as had Salah Abdeslam. The other objects the report describes being found there suggest it may have been one of the places where bombs were assembled, including a piece of cloth identical to one found on the remains of one of the bombers, a roll of the same kind of adhesive tape used on the devices, and two pyrotechnic detonators.
Linked to the Paris attacks

The Hunt for Salah Abdeslam

Brussels Attacks
22nd March 2016
35 people killed, over 300 injured

Post Bombing Incidents
Belgiumâs interior and justice ministers offered to resign, but the prime minister refused, saying he needed them at this âtime of warâ.
All metro stations were reopened on 30th March 2016, except for Maelbeek.
Islamic State claimed responsibility for the explosions, attributing them to a âsecurity group from the soldiers of the caliphate.â It warned ominously of more attacks: âWhat is coming is worse and more bitter, God permitting.â
Information Gaps
Attacks
Reports that Belgian Security Forces acted with uncharacteristic and unexplained swiftness, who sealed off the area to the apartment in Schaerbeek within 90 minutes. The authorities attributed their speedy reaction to a tip-off from the taxi driver. But the driver was said to have alerted the police only after a photograph of the suspects in the attacks was released hours later, raising questions about whether the police had perhaps already had the building in their sights but had failed to act before it was too late. âThere were investigations before and after the eventsâ of Tuesday, Alexandrino Rodrigues, the owner of the building, said in an interview.
Who was the man shot in the leg on 25th March 2016 and was he carrying explosives?
Were there additional safe houses, and if so where?
Where did explosives come from?
How did the terrorists communicate?
Where was the indoctrination centre?
Did the terrorists conduct intelligence surveillance?
How were the terrorists funded?
Any additional information regarding the groupâs supply chain.
Najim Laachraoui
Bernard Clerfayt, the mayor of Schaerbeek, said he had known Laachraoui had gone to Syria but had been at a loss about how to respond. Where did he go to in Syria and when?
Where did he receive his training in making bombs?
El Bachraoui brothers
Why did the brothers drop out of school?
How were the el Bakraoui brothers radicalised in prison and by who?
Were they wearing gloves in order to cover the triggers for the suitcase bombs? If so, why was the
man in white not wearing a glove also?
Why did Ibrahim el Bakraoui ask to be deported to the Netherlands and not Belgium?
The Man in White
How was he meant to detonate the suitcase bomb?
Update

Additional Suspects
What role did the additional people arrested play in the attacks?
What links did they have, if any, to the Paris attacks?
What route did the terrorists take from Leros to Brussels?
Additional information on Zerkani network.
Where could the attacks have been interrupted or stopped?
Mr. Rodrigues said that whenever he visited the apartment in Schaerbeek, the door to the living room was always shut, while windows throughout the apartment were always open. Mr. Rodrigues said he would smell a âvery strong chemical odorâ that he could not quite put a finger on. âIf it smelled like bleach or drugs, I wouldâve recognized it,â he said. Mr. Rodrigues said that while he was mystified by the odor, he never reported anything amiss to the police.
At least one resident in Schaerbeek did make a report to the police, not because of the smell but because of strange comings and goings from the building. Rachid Ghaddih, a longtime local resident who lives around the corner, said nobody in the neighborhood suspected anything related to terrorism but added that the strange goings-on at the building had been brought to the attention of the local agent de quartier, a police officer responsible for keeping a registry of residents and other tasks. The agent de quartier, Philippe Swinnen, declined to be interviewed. Mr. Rodrigues said the officer had stopped by the building at least twice to check whether the names of residents were properly listed, but never entered because the Bakraouis did not list their names. âIt took him three months to figure out that people were livingâ on the top floor, Mr. Rodrigues said, adding: âBut it was too late. Thatâs how things work in Schaerbeek.â
Some of the terrorists and accomplices were well known to intelligence agencies, however, were allowed to either drop off the radar or go unmonitored.
Leros authorities say they simply do not have the resources to screen all the migrants effectively â or even check whether passports are genuine.
Officials now say the signs of this focused terrorist machine were readable in Europe as far back as early 2014. Yet local authorities repeatedly discounted each successive plot, describing them as isolated or random acts, the connection to the Islamic State either overlooked or played down.
Factors of Radicalisation

Channelling grievances into terrorism. What factors are required?

Impact of terrorist attacks on European society

Reactionary Groups
On 27th March 2016, at a memorial for those who were killed in Brussels, a group of 500 people, some of which were reportedly from the right wing group âThe Nationâ protested against terrorism and immigration. The police fired a water canon at the group at least once â as crowds who were originally there to hold a peace rally in the Place de la Bourse cheered.
Terrorist attacks are polarising European opinion on mass migration and as such we are witnessing significant gains for right wing parties and the formation of European militia groups, such as the Soldiers of Odin. The extreme right wing group Soldiers of Odin, that originated in Finland, claims to have 600 members in more than 25 cells across Finland, Sweden, Norway, Denmark, Poland, Germany, Estonia, Hungary â and in Britain and the United States. The group is hostile towards immigrants and claim to patrol the streets to make them safer for ânormalâ people. A number of the members of the group are convicted felons and there are several members with ties to Neo Nazi groups.
The day after the Brussels terror attacks a Spanish far right group, called Hogar Social Madrid set fire to a mosque in Madrid, which had been reportedly supporting Wahabite doctrines and was used to recruit fighters for Islamic State.
The destruction of community cohesion, a tactic of Islamic State
Islamic State are using a tactic in Europe that they have used in Iraq for years. By attacking one community they erode cohesion with the intention of creating a sectarian war. If Muslims feel that far right groups are going to attack them they may seek out help and support from the more radical elements of society, which only serves to add fuel to the problem. European fear of radical Islam will increase prejudice, discrimination, ghettoisation and unemployment, which will only serve to radicalise more Muslims. As more attacks are conducted, far right groups will also gain in support leading to a highly polarised society with right wing one end of the spectrum and the left and Islam on the other end.
Indicators and warnings of a potential sectarian conflict in Europe
Rise in attacks on Islamic targets, such as Mosques, Islamic Centres, people who are perceived to be visibly Muslim, such as women wearing head scarves and attacks on refugee centres.
An increase in anti-migrant and anti-Islamic sentiment.
Middle classes openly stating their disapproval of migration and Islam.
Reported increase in militant/self defence groups.
Conflict between communities.
Segregation and balkanisation in society.
Back to Reports & Resources

About the author

Book a demo