CNN has gotten a great many pages of records and photographs from inward European examinations and assembled data from sources near the Paris examination that together give new insights about the exceptionally composed dread gathering goal on assaulting abroad targets.
These archives uncover new data around two caught agents who specializes trust planned to assault France. They likewise point, chillingly, to the presence of another suspected psychological oppressor - at no other time named openly - who powers case is connected to the Paris fear cell and was free to move around at will in Europe for quite a long time after that assault. That man, distinguished by powers as Abid Tabaouni, was just captured in July.
What's more, the archives shed new light on the exceptionally composed branch of ISIS gave to plotting assaults inside Europe where, even now, sources told CNN, agents anticipate directions from senior handlers in Syria.
"ISIS is expanding its global assault arranging," said Paul Cruickshank, a CNN psychological warfare examiner who added to CNN's examination and editorial manager of CTC Sentinel, a production issued by the Combating Terrorism Center at West Point. "It's undeniably advanced in the way it does this. It's set up a perplexing, logistical emotionally supportive network for these fear based oppressors ... to dispatch these fear monger assaults."
A CNN group invested months experiencing 90,000 pages of archives, the greater part of them in French, that incorporated a trove of cross examinations, investigative discoveries and information pulled from PDAs offering to understand into the outside operations wing of ISIS known as the Amn al-Kharji.
The records appear:
A full representation of the associated fear based oppressors' broad use with online networking stages, for example, Viber, Telegram, and WhatsApp, numerous encoded for secure correspondence. One application let them pick their own telephone number, permitting them to camouflage who was calling them and from where.
how ISIS handlers secure their missions by giving agents just as much data and cash as they have to achieve the following stage; reaching them on every leg of their adventure; and demanding pen names, inside groups.
how the suspected psychological oppressors continually traded logistical exhortation with others in their system, including regardless of whether to utilize genuine names at outskirt intersections and how to sneak over those fringes unlawfully. One tip was to stow away in train restrooms.
A senior European counter-psychological oppression official who addressed CNN said that as indicated by examinations concerning the system that completed the Paris assaults, they were a thinned down form of a much more yearning plan to hit Europe.
In the wake of grilling suspects and assembling insight, European agents now trust that ISIS at first got ready for the agents it sent a year ago to assault the Netherlands, and in addition different focuses in France including shopping territories and perhaps a store in Paris, the authority said.
Also, as of late acquired insight shows that ISIS has ventured up endeavors to penetrate agents into the UK to dispatch assaults there, an authority told CNN.
The senior European counter-psychological warfare official told CNN that security administrations were "revealing increasingly ISIS agents" on mainland European soil. ISIS agents dispatched back to Europe have exploited encryption, particularly the Telegram delegate application, to convey safely, the authority told CNN, baffling European security administrations.
"Encoded informing bunches can possibly alter dread plot arranging by permitting whole cells to organize continuously without bargaining themselves," said CNN psychological warfare examiner Paul Cruickshank.
Europe's security organizations have had essential triumphs, however. One noteworthy leap forward was the catch of two men who powers trust planned to go to France close by the two suicide aircraft who in the long run exploded themselves outside a Paris stadium.
Investigators: Two ISIS attackers who never reached France
Those two suspected ISIS operatives are identified in the documents as Algerian-born Adel Haddadi and his Pakistani travel partner, Muhammad Usman.
Algerian-born Adel Haddadi is a suspected ISIS operative.
Muhammad Usman is a suspected ISIS operative from Pakistan
Documents that detail their capture and extensive interrogations, particularly with Haddadi, show how ISIS supported the attackers throughout their journey from Syria through Europe -- and how future attacks might be organized. The following account of their journey to Europe is based on those documents, which include evidence gathered by investigators, and their conclusions.
Haddadi and Usman, who was identified by investigators as a suspected bombmaker for the Pakistani terror group Lashkar-e-Taiba, set out from the capital of the self-declared ISIS caliphate in Raqqa, Syria, six weeks before the Paris attacks.
They were part of a team, investigators concluded. The two others, Ahmad al-Mohammad and Mohamad al-Mahmod, would later blow themselves up outside the national stadium in Paris. The team crossed the border from Syria into Turkey in early October and headed for the Turkish coast.
Ahmad al-Mohammad was one of the suicide bombers in the Paris attacks.
Mohamad al-Mahmod was one of the suicide bombers in the Paris attacks.
The four men didn't seem to know each other's real names, or what their final mission would be. All Haddadi knew, he later told interrogators, was that they were being sent to France to do "something for the good of God."
The documents show that their journey was directed by a shadowy ISIS leader in Syria, known only as Abu Ahmad. Operating like a puppet-master from afar, Abu Ahmad handled their logistics: connecting them with smugglers and cars for transport, providing pre-programmed cell phones and getting them fake Syrian passports.
He wired them money as they moved, using intermediaries who couldn't be tracked, and communicated using encrypted apps.
"Abu Ahmad ... is key in sending those individuals, at least the foreigners, into the Paris attacks," said Jean-Charles Brisard, president and chairman of the French Center for the Analysis of Terrorism, who reviewed the documents for CNN.
"He is the one who recruited them, who funds them, who trained them," said Brizard. "He was always in contact with them."
Throughout their journey, Abu Ahmad gave the men only enough money and information to get to the next stop, rarely if ever telling them what would happen next, the documents show.
Posing as Syrian refugees
The documents reveal fresh details about their journey and the way they posed as Syrian refugees, blending in with thousands fleeing the war-torn country.
They made the treacherous crossing from Izmir, Turkey, into Greece in a boat filled with dozens of refugees. But they were then intercepted by the Greek Navy.
The two who would go on to strike the Paris stadium passed through Greece and started moving across Europe toward their target in France. Greek officials declined to explain how the two got through.
But Greek authorities discovered Haddadi and Usman's fake Syrian passports. The pair were arrested, their money was taken, and they were held for nearly a month.
Sources told CNN that investigators believe that delay was significant; as a result, they would not have a chance to become part of the Paris attacks.
The Greeks released Haddadi and Usman in late October. They immediately contacted their ISIS handler, Abu Ahmad, who arranged for someone to wire them 2,000 euros. Flush with cash, the pair continued along the refugee route.
It was likely a quiet journey.
The documents show that Usman spoke only Urdu, while Haddadi spoke mostly Arabic. And as they traveled north, Usman was preoccupied with a strikingly un-Islamic hobby -- using his phone to peruse almost two dozen X-rated sites, including "sex later" and "Pakistani Lahore college girls ... ImakeSex."
Both men's phones have given European officials rich investigative veins to mine, revealing dozens of contacts across Europe and the Middle East.
One of the people Haddadi reached out to for help was a technician at one of the most important nuclear research centers in Europe. That man was placed under immediate observation by French authorities, the documents show.
Data pulled from the phones also revealed how the operatives functioned both with extreme care and sometimes, seemingly, by the seat of their pants. In one exchange, Haddadi asks a contact for advice about what to do at a border crossing and whether a friend should use his real name. The friend is so worried about this, Haddadi gripes that he's "driving me crazy."
Algerian-born Adel Haddadi is a suspected ISIS operative.Muhammad Usman is a suspected ISIS operative from PakistanDocuments that detail their capture and extensive interrogations, particularly with Haddadi, show how ISIS supported the attackers throughout their journey from Syria through Europe -- and how future attacks might be organized. The following account of their journey to Europe is based on those documents, which include evidence gathered by investigators, and their conclusions.
Haddadi and Usman, who was identified by investigators as a suspected bombmaker for the Pakistani terror group Lashkar-e-Taiba, set out from the capital of the self-declared ISIS caliphate in Raqqa, Syria, six weeks before the Paris attacks.
They were part of a team, investigators concluded. The two others, Ahmad al-Mohammad and Mohamad al-Mahmod, would later blow themselves up outside the national stadium in Paris. The team crossed the border from Syria into Turkey in early October and headed for the Turkish coast.
Ahmad al-Mohammad was one of the suicide bombers in the Paris attacks.Mohamad al-Mahmod was one of the suicide bombers in the Paris attacks.The four men didn't seem to know each other's real names, or what their final mission would be. All Haddadi knew, he later told interrogators, was that they were being sent to France to do "something for the good of God."
The documents show that their journey was directed by a shadowy ISIS leader in Syria, known only as Abu Ahmad. Operating like a puppet-master from afar, Abu Ahmad handled their logistics: connecting them with smugglers and cars for transport, providing pre-programmed cell phones and getting them fake Syrian passports.
He wired them money as they moved, using intermediaries who couldn't be tracked, and communicated using encrypted apps.
"Abu Ahmad ... is key in sending those individuals, at least the foreigners, into the Paris attacks," said Jean-Charles Brisard, president and chairman of the French Center for the Analysis of Terrorism, who reviewed the documents for CNN.
"He is the one who recruited them, who funds them, who trained them," said Brizard. "He was always in contact with them."
Throughout their journey, Abu Ahmad gave the men only enough money and information to get to the next stop, rarely if ever telling them what would happen next, the documents show.
Posing as Syrian refugees
The documents reveal fresh details about their journey and the way they posed as Syrian refugees, blending in with thousands fleeing the war-torn country.
They made the treacherous crossing from Izmir, Turkey, into Greece in a boat filled with dozens of refugees. But they were then intercepted by the Greek Navy.
The two who would go on to strike the Paris stadium passed through Greece and started moving across Europe toward their target in France. Greek officials declined to explain how the two got through.
But Greek authorities discovered Haddadi and Usman's fake Syrian passports. The pair were arrested, their money was taken, and they were held for nearly a month.
Sources told CNN that investigators believe that delay was significant; as a result, they would not have a chance to become part of the Paris attacks.
The Greeks released Haddadi and Usman in late October. They immediately contacted their ISIS handler, Abu Ahmad, who arranged for someone to wire them 2,000 euros. Flush with cash, the pair continued along the refugee route.
It was likely a quiet journey.
The documents show that Usman spoke only Urdu, while Haddadi spoke mostly Arabic. And as they traveled north, Usman was preoccupied with a strikingly un-Islamic hobby -- using his phone to peruse almost two dozen X-rated sites, including "sex later" and "Pakistani Lahore college girls ... ImakeSex."
Both men's phones have given European officials rich investigative veins to mine, revealing dozens of contacts across Europe and the Middle East.
One of the people Haddadi reached out to for help was a technician at one of the most important nuclear research centers in Europe. That man was placed under immediate observation by French authorities, the documents show.
Data pulled from the phones also revealed how the operatives functioned both with extreme care and sometimes, seemingly, by the seat of their pants. In one exchange, Haddadi asks a contact for advice about what to do at a border crossing and whether a friend should use his real name. The friend is so worried about this, Haddadi gripes that he's "driving me crazy."
Other online conversations, notably with Abu Ahmad, are clearly in code. One message investigators pulled from Haddadi's phone shows the ISIS handler counseling patience, though the exact meaning of his message isn't clear. "Yes, but not yet," it reads, "the drugs are not good."
On November 14, the day after the Paris attacks, Haddadi and Usman arrived in Salzburg, Austria, applied for asylum and settled into one of the city's refugee centers, where they waited for weeks.
Investigators: Planning for another strike
They were waiting for a purpose, according to the documents.
European investigators concluded that Haddadi and Usman were part of the same terror cell as the Paris bombers and, having failed to participate in that bloody day, were planning another strike.
Investigators found that in the days before their arrest, Haddadi and Usman were researching trains to Paris and making a flurry of phone calls overseas, including to contacts in Belgium and France.
The documents also reveal that investigators believe that Haddadi and Usman were waiting for a third man to join them -- Abid Tabaouni.
Abid Tabaouni was arrested in July in Brussels and is a suspected ISIS terrorist, according to the Belgium prosecutor's office.
Tabaouni's name and his alleged role have never before been made public.
As investigators grilled Haddadi and pored through data they collected from cell phones, they asked European police to issue a continent-wide warrant for Tabaouni's arrest.
Like Usman and Haddadi, Tabaouni traveled from Syria along the refugee route, arriving in Salzburg on December 10. He headed to the refugee center where Haddadi and Usman were staying.
The documents outline what happened next: The very day that Tabaouni arrived, Austrian security officials thundered into the center, arresting Haddadi, Usman, and a few others suspected of being connected to the Paris attackers.
Tabaouni was nowhere to be seen. But investigators found his cell phone charging right beside Haddadi's bed.
The documents show that Tabaouni had programmed into his phone a number linked to the terror cell of the ringleader of the Paris attacks, Abdelhamid Abaaoud. He had also saved a photo of ISIS fighters standing before their black-and-white flag.
Haddadi denied knowing Tabaouni, but investigators found Tabaouni had saved Haddadi's phone number in his contacts. The phone also contained a photo taken just 30 minutes before security officials stormed the refugee center. It shows Tabaouni sitting on a bed in between where Haddadi and Usman slept.
The investigators lay out in the documents their belief that Tabaouni was coming to join Haddadi and Usman and that the three men were working on ISIS operations and planning possible attacks.
CNN sources and analysts agree about Tabaouni's likely role.
"We can assume that Tabaouni was also part of the same plot," said Brisard, the French terror expert. "And (that he) was instructed to carry out an attack."
From the moment he slipped away in December, Tabaouni was a wanted man, according to several CNN sources.
An arrest is made
The Belgian prosecutor's office told CNN that Tabaouni, who is Moroccan, was only arrested in Brussels in July and will soon be extradited to Austria. He was taken into custody as soon as he was located, according to a senior European terrorism official.
Haddadi and Usman were extradited to France, where they face terrorism charges, according to senior European counterterrorism sources, who also say they will be trying to tie Tabaouni to Haddadi and Usman and the Paris attackers.
While he was on the loose, Tabaouni was openly using a Facebook account that is identified in the documents by its unique ID number and was publicly posting updates from Belgium, where he was arrested. None of his postings indicate any apparent terrorist leanings or affiliations.
Investigators are now analyzing more than 1,600 pages of data from Tabaouni's phone in hopes of learning more about his movements and contacts.
Several sources told CNN there are probably more sleeper cells and ISIS operatives coming into Europe using the same crowded, chaotic refugee route exploited by Haddadi, Usman and Tabaouni.
"We've seen that in the recent weeks, several of them, individuals who carry out individual attacks, inspired attacks, were coming back from Syria using the same route," Brisard said.
"In addition to that, several jihadists have been arrested all around in France ... in Belgium and Germany using the same route, for the same purpose," Brisard said.
The treasure trove of information that investigators gained from the interrogations and the data extracted from the phones may help authorities better identify future plotters. Even after the arrests in Austria, Haddadi's phone was still active.
On December 15, five days after the refugee center raid, the documents show that the team's ISIS handler, Abu Ahmad, reached out to his operatives. He messaged Haddadi, perhaps wondering about their silence.
"How are you," he wrote. "What has become of you?"
There was no reply.
