In less than three months’ time, France will welcome millions of international and domestic visitors for a major international sporting event, Euro 2016. French authorities have already described the tournament as ‘an ideal show-window’ for terrorist groups.
In that light, the arrest of Saleh Abdeslam over the weekend — now confirmed as the aborted 10th suicide bomber from November’s attacks in Paris — is good news.
Already, intelligence leads from the raid are helping flesh out the wider network of the Paris attackers, while the initial signs are that Abdeslam is cooperating with investigators.
If this cooperation continues, Abdeslam’s capture could deliver a significant intelligence windfall. Given his role, he is likely to have a good understanding of the Paris attacks’ logistics. And after four months on the run, he will have current and vital intelligence on jihadist support networks in France and Belgium.
Abdeslam may also be able to identify some of the Europe-based individuals involved in the attack, perhaps including the elusive ‘bomb maker’ who was so capable at building suicide vests using the notoriously unstable TATP. And all of this information can hopefully be used to identify and disrupt terrorist networks in Western Europe.
But Abdeslam is no ringleader or ‘mastermind’. Nor has he travelled to the Middle East or met senior ISIS leadership. So while he can provide a critical insight into operational logistics, he is unlikely to have all the answers or knowledge of future ISIS-directed attacks against the West, including Euro 2016. [fold]
The circumstances surrounding Abdeslam’s arrest are also a cause for concern. He was eventually captured in Molenbeek, Brussels, the epicentre of Belgian jihadism and the subject of extensive law enforcement activity over the last four months. And he reportedly had access to weaponry that would have allowed him to conduct further attacks.
This highlights two worrying and inter-related trends. First, the sheer size of the attackers' support network, which investigators now put at over 30 individuals. And second, despite their success in capturing Abdeslam alive, the inability of the Belgian authorities to adequately deal with a disproportionately large extremist problem.
Abdeslam’s arrest also coincided with the leaking of a 55-page report, compiled by French anti-terrorism police in the weeks after the Paris attacks. Of particular importance, given the implications for future attacks, is understanding how such a big group evaded detection by the authorities.
Here we have some answers, but also more questions. It appears that the group’s communications — at least during the operational phase of the attack — were unencrypted. Instead, the attackers used a communications strategy first popularised in HBO’s The Wire – burner phones.
However, investigators have so far only recovered phones that were either unused, or used immediately before and during the attack. It is less clear what happened in the weeks and months prior to 13th November, and how (if at all), the Belgium-based network communicated with individuals in Syria and Iraq. These are hopefully intelligence gaps that Abdeslam can fill.
What is of greater significance is that network members appear to have almost exclusively communicated by phone call, a method typically susceptible to interception. In taking this risk (albeit alleviated by use of burner phones), the network has limited the retrospective evidentiary trail.
As a result, authorities have been unable to look (or try to look) at the content of these communications to discover who gave the orders, what they were, and who they were in contact with in Belgium immediately prior to the attacks. The creation of 10 suicide vests makes it clear that none of the attackers were meant to be captured alive. This is why Abdeslam’s arrest could be so pivotal.
In part because of these communications methods, the leaked report is noteworthy for what it does not include. The New York Times article containing the report refers to an ‘evolution in ISIS thinking and strategy’. But we’re no clearer on who in the chain of command was responsible for this evolution. Or why. Without this, it is much harder to predict where ISIS might attempt to strike next and how.
That said, having demonstrated the intent and capability to target sporting events before (including in Paris), it would be unsurprising if ISIS-inspired or directed networks do not have Euro 2016 firmly in their sights.
However, much has changed since November 2015. Cross-European intelligence sharing has been stepped up. French authorities are exercising unprecedented and controversial ‘emergency powers’. Measures are being put in place to stymie the free-flow of people across Europe. And ISIS continues to suffer losses to its territory and manpower in Syria and Iraq.
Clearly, there are never any guarantees when it comes to terrorism. But we can at least conclude that anyone targeting France before or during Euro 2016 will face a much tougher operating environment. And that many of the gaps exploited by the Paris attackers have been closed.
Photo by Carl Court/Getty Images