What the Paris Attacks Represent
Earlier this month, a small group of terrorists conducted a horrific attack in one of the world’s great cities. According to witnesses, one attacker shouted “This is for Syria” — a glimpse of what the attackers intended their attack to represent. In what has become an all too common post script to recent attacks, we have learned that some of the network was already known to authorities. As The Soufan Group put it, intelligence services have increasingly been “a hindsight machine.”
Why is that? The scope of the challenge, the resources harnessed to counter that challenge, and a steady decline of security and governance in several regions of the world have made us all less safe.
Understanding the enemy requires one to know its composition, capabilities and intent. That has been my understanding when confronting violent extremists at least. Countering those groups requires degrading composition and capabilities and obstructing intent. We are failing to meaningfully impact the Islamic State and Al Qaeda on all three points.
The biographies of many of the Paris attackers as well as their support networks are becoming known. Their capabilities are now better understood. We are beginning to understand their intent, although I would argue that this is the most speculative part of the analysis as of now (fear not, I shall speculate soon).
Three disturbing trends have emerged. First, they seem to have been relatively good at maintaining OPSEC. Second, when confronted by authorities after the attack, they were willing and capable of conducting a sustained fight. During the raid that killed the attack’s coordinator, about 5,000 rounds were fired. Similarly, after a raid in January that seems linked to this individual as well, authorities remarked that they were in the largest firefight in their recollection. The cell behind the 2004 Madrid attacks was similarly motivated, but authorities have remarked that they are up against combat veterans now. Lastly, terror cells are improvising and attempting to improve upon previously successful plans. Bin Laden wanted something like a European Mumbai attack in 2010. The Islamic State seems to have pulled it off.
Intelligence and law enforcement obstacles have become apparent as well. France has a reputation for very capable counterterrorism operations. However, the scope of the challenge has overwhelmed their resources. Politically lethargic Europe must now come to grips with the security problem that their federation has if smaller states (or any state) in their federation are overwhelmed. Illicit networks have long thrived in the under resourced corners of global law enforcement. Not surprisingly, now terrorists are exploiting these weaknesses as well.
The Oversights
The Paris attack serves as an example in failing to assess and counter a terror cell’s composition, capabilities and intent. A suspect informed French authorities in August that he had been sent back from Syria by Abdelhamid Abaaoud with instructions to attack a music venue. Abaaoud had been on the radar for some time, but it was not until after the attacks in Paris that authorities became aware that he had a cousin in the city, Hasna Ait Boulahcen, who was under surveillance for drug-trafficking ties. The link between Abaaoud and Boulahcen was established via Moroccan intelligence. French and Moroccan authorities had seen their counterterrorism relationship suffer after a magistrate from the former colonial power began investigating allegations of torture in their former colony. That lead to the pause in cooperation between the two countries.
Much closer to France, there was a different challenge. Belgium is politically and socially fractured even without considering the depressing economic prospects for residents in Molenbeek. Brussels has six police forces operating alongside a federal police force. Senior positions are politicized, the country holds the record for the longest period of time without a government, and politics is split often on ethnic and linguistic lines. As a political commentator said in the New York Times, “everyone always says it is not their fault, and they are often right.” Prior to the attacks earlier this month, Belgian authorities had insufficient resources and too many threats to track. They were also legally restrained in their surveillance.
While reports of increasing militant awareness of OPSEC and their use of encryption are alarming, many operatives nonetheless make mistakes that can be quickly exploited (Wired). As every reasonable person has concluded, encryption is not necessarily a great thing to allow terrorists to have but it is highly desirable for maintaining innocent people’s privacy and preventing cyber crime. There is no reason to believe that governments would have necessarily been able to stop this attack if encryption were no obstacle. Belgium would have still been a mess and France may very well have still been trying to connect the dots around Abaaoud. These attacks, however, do demonstrate that SIGINT is important to counterterrorism (both foreign and domestic) but it is also insufficient unless Human Intelligence sources are available (and willing to speak to authorities) and analysts are also used to their full potential. Authorities in Brussels were asking for more resources but were receiving only minimal increases in budgets and staffing. After the attacks, of course, the resource allocation increased exponentially.
The Network
Whether Abdelhamid Abaaoud is deserving of the title of “mastermind” for these attacks or was merely a well-connected operative is up for debate (Daily Beast). Salim Benghalem may be a bigger fish, or perhaps this attack has more to do with Boubaker al Hakim. Some reports place Abaaoud as a member of a powerful “Libyan” battalion in IS, which may have posed IS leadership with autonomy challenges. This unit may also be responsible for spreading IS operatives around the world — perhaps under direction from the group’s leadership, perhaps not. Determining control and intent are more difficult. At higher echelons, our understanding of this attack is necessarily more limited. U.S. officials were aware of “vague but credible” threats to France in September (New York Times). The tip in August, in retrospect, was a missed opportunity.
What we know about Abaaoud indicates that he constructed — or fell back upon — his terror network built largely on personal connections. Like other terrorists, he was not necessarily always living life on the margins — he attended a prestigious private school before turning delinquent. As noted above, Boulahcen was Abaaoud’s cousin. Two attackers were brothers, one spent time in jail with Abaaoud. One of the brothers discarded his suicide vest and fled Paris, aided by friends who are now facing prosecution in Belgium. These brothers had previously been owners of a seedy bar in Molenbeek, reputed to be a haven for drugs and men with short tempers. I haven’t read any article yet that draws a definitive link between drugs, gangs, guns and this cell — but that link is probably there. The bar was closed by authorities prior to the attacks, with the brothers selling their stakes before the closure. Other plots in France and Belgium have also traced back to Molenbeek.
While there has been much ballyhoo about refugees radicalizing or serving as a conduit for moving suicide bombers (real logisticians and organizers will be moving with far greater ease), these sentiments neglect the significant number of European citizens and residents who have already fought in Syria. Moreover, the illicit networks are the means with which guns, ammunition, money, and even military grade explosives will transit into Europe. Refugees are a rather poor infiltration approach for those materials — they tend to get searched and questioned.
The Islamic State
Counterterrorism officials in the U.S. and Europe have told the Wall Street Journal that the Islamic State has sent lieutenants to organize attacks outside of the so-called Caliphate. These intelligence sources point to recent attacks in Beirut and Ankara as clearly directed from IS leaders in Syria and Iraq. The recent bombing in Beirut served as a challenge to Hezbollah. A number of commentators have noted that the Islamic State is now seeming to implement strategies outlined in The Management of Savagery. Ankara was something different — it was intended to split Turkish politics along a very sensitive fissure. The attack in Paris is more like Ankara than Beirut.
European operatives are particularly beneficial to the Islamic State as their passports provide greater flexibility with travel. European sources also tell the WSJ that these operatives are using smuggling networks within the continent. Much has been made of the apparent shift for the Islamic State from the Near Enemy (Syria, Iraq, etc.) to the Far Enemy. But, this strategic shift has been overplayed by many commentators. The Islamic State has been operating in numerous countries and threatening the West for some time. At some point, there probably was a shift from recruiters to operational lieutenants in far flung regions, but that shift happened well before these most recent attacks. The intent of Paris, I believe, is to split European politics along lines favorable to the Islamic State.
There are reports that several attackers used the refugee crisis to move from Syria and conduct the Paris attack. Almost immediately after the attacks, a Syrian passport was found near one of the suicide bombers. Predictably, anti-Europe and anti-immigrant parties in the West have latched on to this apparent threat. This is a mistake for several reasons. First, key individuals in this network were citizens of France. Moreover, the most essential operational planning for this attack likely took place in Belgium and France. Based on the sophistication of the suicide vests, these likely were also made in Europe. Most importantly, however, is that a right-wing backlash against Muslim citizens in Europe and refugees is precisely the goal of the Islamic State with this attack.
What this Represents
As Jean-Pierre Filiu (Politico) has noted, jihadists in the Levant have been attempting to attack France and Belgium before the Islamic State even identified itself with that title. In May of 2014, Mehdi Nemmouche, previously a jailer for ISIS, killed four people in Brussels at a Jewish museum. The Charlie Hebdo attackers were members of a militant cell broken up during the initial occupation of Iraq about ten years ago. The group may wish to provoke a ground offensive by Western forces — possibly the same motive for the Sinai passenger jet attack. If that was the motivation, then the West seems unwilling to bite. The group almost certainly also wants to further isolate Muslims in Europe and fuel the right-wing backlash against immigrants on the continent. It is an old insurgent tactic to jeopardize the safety of the community supposedly represented by the insurgents so that this community has no other option but to side with the insurgents. To give in to these sentiments would be to turn a tactical Islamic State victory into a strategic one.
