Posted tagged ‘European intelligence’

Europe’s Terror Challenges: The Returnee Threat

October 19, 2016

Europe’s Terror Challenges: The Returnee Threat, Investigative Project on Terrorism, Abigail R. Esman, October 19, 2016

(Please see also, Sweden: Returning Islamic State jihadis to get free housing, driver’s license, tax benefits. — DM)


Another week, another barrage of headlines illustrating the depth of Europe’s terror threat. The following examples came during a 24 hour window earlier this month: “Schiphol Airport Was Possibly A Target Of Terror Cell That Attacked Paris;” “Police In Brussels Stabbed In Possible Terror Attack;” and “MI5 Missed Chance To Foil Paris And Brussels Attacks.”

It is news to no one that Islamic terrorism is everywhere now, and principally in Northern and Central Europe. But the three news stories, and the Schiphol and MI5 revelations in particular, demonstrate the enormity of the challenges now facing European counterterrorism officials.

Intelligence and law enforcement continue to fumble in handling the threat, often through no real fault of their own. The perpetrators are slippery and elusive. Sometimes they travel under false names. Some slip in as refugees, using false passports and false histories. Others are returnees from Syria whose activities and encrypted Telegram communications slide beneath the radar, even as they are being watched. And overtaxed law enforcement agencies have made any number of mistakes, overlooking suspicious behavior or releasing suspects without adequate investigation – in part a consequence of political pressures and the fear of being accused of “Islamophobia” by politicians and the press.

As it turned out, the suspect in the Brussels knife attack was a former Belgian military officer already known to the police for his connections to fighters in Syria. To date, officials have not determined whether he has been to Syria or ISIS territory in Iraq.

But the contact with ISIS and other terror groups in the self-declared caliphate is a common link, not only among the known perpetrators of last November’s Paris attacks and the March attacks in Brussels, but among their alleged colleagues planning to attack Schiphol airport. Those two men, identified as the Tunisian Sofien Ayari and Syrian-Swedish Ossama Krayem, traveled by bus from Brussels to Amsterdam on Nov. 13, the day of the Paris massacre. Both used false IDs. They returned, still undetected, the following day.

Four months later, police raided a safe house used by the terror cell in Schaarbeek, a Brussels neighborhood, and retrieved a laptop computer containing files labeled “13 November.” Included in those files were documents referring not only to “Stade de France” and “Bataclan” – both targets in the Paris killings – but also to a “Schiphol group.”

It is not clear why Ayari and Krayem returned to Brussels without executing an attack on the Dutch airport, and the Dutch National Coordinator for Counterterrorism and Security (NCTV) office will not comment on the case, leaving information sketchy.

But there may be clues: Ossama Krayem was also spotted on CCTV at the Brussels Metro station that was bombed on March 22; his lawyers maintain that he decided against detonating his backpack. Did he panic and back out of the Schiphol attack, as well?

Following a worldwide manhunt, Belgian police arrested Salah Abdeslam, one of the few surviving organizers of the Paris attacks, on March 18 in the Brussels district of Molenbeek. Little notice was given at the time to the other man arrested with him: Sofien Ayari. Three weeks later, after the March 22 attack on Zaventem airport and Brussels’ Maalbeek metro station, police also captured Mohamed Abrini, frequently referred to as “the man in the hat” and a key player in the Zaventem bombing. Also arrested, though also little noted at the time, was Ossama Krayem. All four remain in detention.

While it has likely been known for some time by French prosecutors, the connection to the Schiphol airport plot was only released publicly earlier this month.

Indeed, the latest disclosures show that the Paris-Brussels cell reached as far as Amsterdam and the UK, as members traveled back and forth among all four countries. No one even noticed. Worse, UK officials put a stop to an undercover investigation of a British group with connections to Abrini months before the attacks, citing insufficient evidence. Had that probe continued, it may have led them to Abrini – who frequently visited the British group under orders from Syria-based leaders, experts believe.

Why would that have mattered? Because Abrini was allegedly receiving orders from Abdelhamid Abaaoud, the mastermind of the Paris attacks and of “at least four” foiled terror plots across the country, according to French Interior Minister Bernard Cazeneuve. And Abaaoud, said to be one of ISIS leader Abu Bakr al-Baghdadi’s right-hand men, was regularly going back and forth between Syria and France. According to CNN, Abaaoud allegedly bragged in ISIS’s online magazine, Dabiq, “I was able to leave and come to Sham (Syria) despite being chased after by so many intelligence agencies. My name and picture were all over the news yet I was able to stay in their homeland, plan operations against them, and leave safely when doing so became necessary.”

Experts agree that returnees like Abaaoud form the greatest terror threat right now. It isn’t simply a matter of their ability to bring the lessons of the battlefield – bomb-building, sharp-shooting, and an emotional resistance against killing – to Europe’s villages and cities. It is their ability to recruit new “soldiers for ISIS,” some of whom will follow the returnees back to Syria, and others who will be ordered to remain and carry out attacks at home. And while most European countries have severe penalties for those found guilty of aiding terrorist groups, many returnees, like Abaaoud, simply don’t get caught.

Moreover, because there is rarely hard evidence available of violence or terrorist acts in Syria, convicting returning ISIS fighters for their actions there is more difficult than it might seem. Smart-phone data from some returnees, however, has occasionally offered up photographs, videos, and other material that can be used as evidence. Consequently, their sentences can be comparatively light, less than 10 years in Germany and the UK, and usually lower for those who cooperate with authorities.

Others may not face prison at all. A report by the Dutch intelligence service AIVD points out that many returnees come home disappointed by the realities they encountered. Those who were not seen as fit to fight were reduced to menial jobs like housekeeping, and cannot be said to have engaged in terrorist activity, and so, cannot be convicted.

At the same time, often “even those who did not fight continue to be involved in jihadist circles” when they come home, the AIVD reports. Others, according to a separate report published by the NCTV, join criminal groups, possibly as a way to raise money to send back to Syria and Iraq. And while many appear to retreat, having little social interaction, the NCTV says, this does not mean that they have given up their jihadist visions. Quite likely they are encouraging others through social media, in mosques, and in small groups.

And so the cycle continues.

There is some good news. Through new initiatives, European intelligence bureaus aresharing more information, making it less likely that someone like Abaaoud would be able to cross borders undetected. Such alerts would also bring attention to those returnees and other suspected jihadists might meet with, even in a foreign country (as Abrini met with British jihadists before the Paris strike).

More important are de-radicalization programs, which aim to change either the behavior (known as “disengagement”) or the mindsets of jihadists, essentially challenging and discrediting their radical Islamist ideas. How well these programs work is still uncertain, though experts increasingly agree that altering violent behavior alone is not enough.

Because jihadists work by spreading an ideology, it is that ideology that needs to be attacked. And because prisons are often precisely where radical Islamic ideologies are preached and spread, counterterrorist experts are starting to say that sending jihadists to prison is not sufficient.

“We’ve seen in many other countries that when you arrest one, you create three other extremists,” German deradicalization expert David Kohler told Frontline. “It helps to spread the idea, and proves to the movement that they are right, that they are under attack.”

Granted, this is hardly a short-term strategy. But as the number of people returning from Syria to the West grows, and as their reach into the hearts and minds of Western Muslims deepens, it may be the one chance that we have to bring the cycle of Islamist terror to an end.

How Muhammad Dalil toyed with European security

July 31, 2016

How Muhammad Dalil toyed with European security, DEBKAfile, July 31, 2016

(A short biography of an Islamist terrorist and how he fooled the Europeans. — DM)

ISIS_PROUD_7.16(ISIS publishes a graph to boast about the scale of its victims

German intelligence and its other European counterparts knew everything they needed to know about Muhammad Dalil to hold him in check – even his ISIS code name: Abu Yusuf al-Karrar. Nevertheless, on July 24, he was able to approach the gate of a music festival in the Bavarian town of Ansbach and, after being turned away, was left free to blow himself up outside a nearby wine bar and injure 15 people, some of them badly.

The Dalil episode strikingly illustrates the serious ineptitude of the agencies assigned to fighting terror in Europe, along with the rising graph of victims – 443 dead in Europe in the past three years.

The death toll from terror in 2014 stood at 4, two of them Israelis, Emanuel and Miriam Riva; in 2015, the figure shot up to 267. In the first seven months of 2016, there were 172 fatalities – i.e. an average of 24.5 per month.

The three-year total of injured victims has moreover reached 3.000.

The case of Muhammad Dalil serve as an object lesson, from which Europe’s counter-terrorism agencies could learn from this and other past experiences of this kind what not to do and the high importance of tightening operational intelligence and discipline in their ranks.

His resumé is instructive.

Starting his career as a terrorist in al-Qaeda, Dalil fought the Americans in Iraq for years in the second half of the 2000s.  When the Syrian civil war broke out in 2011, he slipped across the border and joined the Islamist Nusra Front.

His combat experience in Iraq jumped-started his rise in the ranks until he was put in charge of Nusra’s unit for terror attacks on he Syrian army. His specialty was rigging large incendiary bombs, a more sophisticated and powerful version of firebombs.

Dalil soon made himself one of the most wanted men for President Bashar Assad’s security agencies.

As part of Assad’s effort to show he was fighting radical Islamist terrorists – and not his own political opponents – Assad instructed his intelligence agency to turn the Muhammad Dalil file over to Western intelligence services.

In 2013, Dalil made another move – from Nusra Front to ISIS, swearing allegiance to its leader Abu Bakr al-Baghdadi.

At the end of 2015, he was injured by shrapnel in a battle. French Muslim doctors employed by ISIS advised him that he could only save his life by getting admitted to a hospital in Germany for the best treatment available. The French doctors prepared him for the journey and ISIS supplied with false passports.

Muhammad Dalil crossed the border from Syria to Turkey and thence to Bulgaria by joining the flow of Syrian migrants. From there, it was a short journey to a German hospital.


The point is that German intelligence, having identified him from the Syrian tip-off, knew who he was and kept track of his movements along this journey. Still, after he was given the best care at the German hospital and recovered, he was allowed to set up residence at Ansbach and apply for a permit to settle in Germany.

From his Ansbach apartment, he was soon hard at work disseminating ISIS doctrine across Europe’s social networks. When no one interfered to stop this, he turned to action.

Using his Syrian experience in building large incendiary bombs, he turned his apartment into a bomb-making workshop. But realizing that it was too dangerous to store the large amounts of fuel needed in the apartment and fearing the smells would alert the neighbors’ suspicions, he decided to switch production from large bombs to explosive devices designed for suicide attacks.

According to DEBKAfile’s counterterrorism sources, Dalil began building these bombs at the end of April 2016, roughly three months before he actually set one off outside the Ansbach wine bar.

Meanwhile, he kept on renewing his application for a permanent status and extending his stay in Germany each time it was denied. Two months prior to the attack, German intelligence and security agencies conducted a search of his apartment.

It is hard to understand how the searchers found nothing, although three bombs were hidden there in various stages of production.

The terrorist timed the finish of his work for July 24, the date of the Ansbach rock concert. His plan was to detonate a bomb in the audience of 2,500 young fans. Because he hadn’t bought a ticket, the security guard at the gate and the ushers turned him away, but none were suspicious enough to force him to surrender to a search of his knapsack, which in fact contained the bomb he blew up shortly after.

There is no doubt that there are more Mohammad Dalils at large across Europe. His case shows that coming under the authorities’ radar may not alone be enough to hold these jihadist terrorists back from their vicious rampages.