Steps of Screening Refugees

Posted on by

WallStreetJournal: This week dozens of state governors said they would refuse Syrian refugees, citing national security concerns after the Paris attacks. The Obama administration pushed back on those announcements and stressed that the governors had little power to do so. But they also pledged to explain the program to those doubting it could screen out potential terrorists. Here’s a breakdown of how the program works.

* * *

Q: What kind of screenings do Syrian refugees go through?

A:  Refugees from all countries receive “the most rigorous screening and security vetting of any category of traveler to the United States,” a senior administration official told reporters Tuesday.  That process includes biographic and biometric security checks – i.e. checking records and doing fingerprinting.  Law enforcement, the Pentagon and the intelligence community all vet information provided by and obtained about refugees to help make a determination about whether they will ultimately be allowed to come to the U.S. Syrian refugees go through an enhanced review process on top of that with extra national security checks. All Syrian refugees considered for resettlement in the U.S. are interviewed in person by specially trained staff, mostly in Amman and Istanbul, but also in Cairo and elsewhere. Refugees must also undergo health screenings and a cultural orientation before they arrive in the U.S.

Q: How long does it take?

A:  The process usually takes between 18 to 24 months and generally begins with a referral from the U.N. refugee agency. Those referrals include biographic and other information that the Department of Homeland Security uses to determine if the cases meet the criteria for refugee status. If DHS decides a refugee qualifies on one of five protected grounds – race, religion, nationalist, political views or belonging to a certain social group, the extensive screening processes described earlier begin. For comparison, an international student seeking to study in the U.S., for example, usually schedules a consular interview three to five months in advance of beginning schooling.

Q:  Who are the Syrian refugees coming to the U.S.?

A:  Half of the Syrian refugees resettled in the U.S. so far are children, according to a senior administration official. Of the rest, 2.5% are adults over 60 and 2% are single men. The refugees are roughly half men and half women, with slightly more men.

Q:  How many are here now?

A:   Since the Syrian crisis began in 2011, the U.S. has admitted about 2,200 Syrian refugees. That’s a very small chunk of the more than 332,000 refugees who have come to the U.S. during the same period. The Obama administration has pledged to take in at least 10,000 in fiscal year 2016, which began in October. Over 4 million people have fled Syria since the crisis began in March 2011. Most are located in countries in the region.

Q: Where are Syrian refugees living in the U.S.?

A: The top resettlement states for Syrian refugees are California, Texas, Michigan, Illinois and Arizona. Overall 36 states have taken in Syrians since 2011.

Q: What happens once a refugee arrives to the U.S.?

A:  Refugees are required to adjust their status to become legal permanent residents within one year of arriving to the U.S. Each week the nine networks of nonprofits that work with the State Department to resettle refugees meet to decide where to send refugees arriving here. Those decisions are based on where their family members might be located, which states have low unemployment rates and what cities might be able to provide specialized medical treatment, for example. Officials usually try to resettle refugees in medium-size cities like Nashville, Tenn., and Buffalo, N.Y. that aren’t too expensive. But once refugees get here, they are free to live wherever they wish, officials said.

*** Then there is the Office of Refugee Resettlement, a division of Health and Human Resources.

The Office of Refugee Resettlement (ORR) gives new populations the opportunity to maximize their potential in the United States.  ORR’s programs provide people in need with critical resources to assist them in becoming integrated members of American society, such as cash, social services, and medical assistance.

ORR benefits and services are available to eligible persons from the following groups:

  • Refugees
  • Asylees
  • Cuban/Haitian entrants
  • Amerasians
  • Victims of human trafficking
  • Unaccompanied alien children
  • Survivors of torture

ORR has five divisions and one major program area:

  • Refugee Assistance
  • Refugee Health
  • Resettlement Services
  • Children’s Services
  • Anti-Trafficking in Persons
  • Office of the Director

Division of Refugee Assistance:

The Division of Refugee Assistance (DRA) supports, oversees and provides guidance to State-Administered, Public Private Partnership and Wilson/Fish programs that provide assistance and services to refugees, asylees, certain Amerasian immigrants, Cuban and Haitian entrants, and Certified Victims of Human Trafficking (henceforth referred to collectively as refugees). DRA reviews and monitors state plans, budget submissions, service plans, and reports, while providing technical assistance to ensure that federal regulations are followed and adequate services and performance are maintained.  The ultimate goal is to provide the types of assistance that will allow refugees to become economically self-sufficient as soon as possible after their arrival in the United States.

Program structures:

  • State Administered: Cash, medical, and social services are primarily managed by states as part of their social service or labor force programs.  The program goal is to enable refugees become self-sufficient as soon as possible.
  • Public Private Partnership: This partnership provides States the option to enter into a partnership with local voluntary resettlement agencies to provide cash assistance to refugees.  The objective is to create more effective resettlement, while maintaining state responsibility for policy and administrative oversight.
  • Wilson-Fish: The program is an alternative to the traditional state administered refugee resettlement program.  This program provides cash, medical assistance, and social services to refugees.  The purpose of the Wilson-Fish program is to increase refugee prospects for early employment and self-sufficiency, promote coordination among voluntary resettlement agencies and service providers, and ensure that refugee assistance programs exist in every state where refugees are resettled.

DRA is responsible for the following programs:

  • Cash and Medical Assistance: This program provides reimbursement to states and other programs for cash and medical assistance. Refugees who are ineligible for TANF and Medicaid may be eligible for cash and medical assistance for up to eight months from their date of arrival, grant of asylum, or date of certification for trafficking victims.
  • Refugee Social Services: This program allocates formula funds to states to serve refugees who have been in the United States less than 60 months (five years).  Services are focused on addressing employability and include interpretation and translation, day care, citizenship, and naturalization.  Services are designed to help refugees obtain jobs within one year of enrollment.
  • Targeted Assistance Formula: This program allocates formula funds to states that qualify for additional funds due to an influx of refugee arrivals that need public assistance.  TAG service prioritize (a) cash assistance recipients, particularly long-term recipients; (b) unemployed refugees not receiving cash assistance; and (c) employed refugees in need of services to retain employment or to attain economic independence.
  • Cuban Haitian: This program provides discretionary grants to states and other programs to fund assistance and services in localities with a heavy influx of Cuban and Haitian entrants and refugees.  This program supports employment services, hospitals, and other health and mental health care programs, adult and vocational education services, refugee crime or victimization programs, and citizenship and naturalization services.
  • Refugee School Impact: This program provides discretionary grants to state and other programs.  Funds go to school districts to pay for activities that will lead to the effective integration and education of refugee children between the ages of 5 and 18.  Activities include English as a second language; after-school tutorials; programs that encourage high school completion and full participation in school activities; after-school and/or summer clubs and activities; parental involvement programs; bilingual/bicultural counselors; interpreter services, etc.
  • Services to Older Refugees: This program provides discretionary grants to states to ensure that refugees aged 60 and above are linked to mainstream aging services in their community.  ORR cooperates with the Administration for Community Living to reach this goal.
  • Targeted Assistance Discretionary: This program provides discretionary grants to states and other programs to address the employment needs of refugees that cannot be met with the Formula Social Services or Formula Targeted Assistance Grant Programs.  Activities under this program are for the purpose of supplementing and/or complementing existing employment services to help refugees achieve economic self-sufficiency.
  • Technical Assistance Program: This program provides technical assistance grants to organizations with expertise in specific areas, such as employment, cultural orientation, economic development, and English language training.

Division of Refugee Health
ORR recently created the refugee heath program to address issues of health and well-being that are vital to refugees and other ORR-eligible populations. The refugee health program works on various projects including: collaborating with federal partners in the implementation of the Affordable Care Act (ACA); administering the Survivors of Torture and Preventive Health programs; and providing technical assistance on medical screening guidelines, assessment and follow-up for contagious or communicable diseases, mental health awareness and linkages, suicide prevention, emergency preparedness and other health and mental health initiatives. It also coordinates with state and federal partners to advance ORR’s overall health initiatives.

DRH is responsible for the following programs:

  • Refugee Preventive Health: This program provides discretionary grants to states or their designated health agencies or other programs that facilitate medical screenings and support health services.  The program aims to reduce the spread of infectious disease, treat any current ailments, and promote preventive health practices.
  • Services to Survivors of Torture Program: This program provides funding for a comprehensive program of support for survivors of torture.  The Torture Victims Relief Act of 1998 recognizes that a significant number of refugees, asylees, and asylum seekers entering the United States have suffered torture.  The program provides rehabilitative services which enable survivors to become productive members of our communities.

Division of Resettlement Services
The Division of Resettlement Services (DRS) provides assistance through public and private non-profit agencies to support the economic and social integration of refugees. DRS is responsible for the following programs:

  • Matching Grant Program: This is an alternative program to public assistance designed to enable refugees to become self-sufficient within four to six months from the date of arrival into the United States.  Eligible grantees are voluntary agencies able to coordinate comprehensive multilingual, multicultural services for refugees at local sites; the same agencies are under cooperative agreements with the Department of State/Bureau of Population, Refugees and Migration (PRM).
  • Refugee Agriculture Partnership Program: The Refugee Agriculture Partnership Program (RAPP) involves refugees in the effort to improve the supply and quality of food in urban and rural areas.  Refugees are potential farmers or producers of more healthful foods, as well as consumers whose health and well-being are affected by diet.  RAPP has evolved into a program with multiple objectives that include: creating sustainable income; producing supplemental income; having an adequate supply of healthy foods in a community; achieving better physical and mental health; promoting community integration, and developing the capacity of organizations to access USDA and other services and resources.  In cooperation with the USDA, ORR helps develop community gardens and farmers’ markets.
  • Preferred Communities Program: This program supports the resettlement agencies of newly arriving refugees by providing them additional resources to help refugees to become self-sufficient and to integrate into their new communities.  The program also assists service providers that assist refugees with special needs that require more intensive case management.
  • Ethnic Community Self-Help Program: This program provides assistance to refugee ethnic community-based organizations (ECBOs) that address community building and facilitate cultural adjustment and integration of refugees.  The program’s purpose is to promote community organizing that builds bridges between newcomer refugee communities and community resources.
  • Microenterprise Development Program: This program enables refugees to become financially independent by helping them develop capital resources and business expertise to start, expand, or strengthen their own business. The program provides training and technical assistance in business plan development, management, bookkeeping, and marketing to equip refugees with the skills they need to become successful entrepreneurs.
  • Microenterprise Development – Home-Based Child Care Program: This program is designed to enable refugee women to become entrepreneurs while simultaneously caring for their own children.
  • Individual Development Accounts Program: Individual development accounts are matched savings accounts available for the purchase of specific assets.  Under the IDA program, the matching funds, together with the refugee’s own savings from his or her employment, are available for one (or more) of the following: home purchase; microenterprise capitalization; post secondary education or training; and in some cases, purchase of an automobile if necessary to maintain or upgrade employment.  Upon enrolling in an IDA program, a refugee signs a savings plan agreement, which specifies the savings goal, the match rate, and the amount the refugee will save each month.  Refugees also receiving training in navigating the financial system, budgeting, saving, and credit.

Division of Children’s Services
The Division of Children’s Services (DCS) recognizes the importance of providing a safe and appropriate environment for unaccompanied alien children during the interim period between the minor’s transfer into ORR care and reunification with family or other sponsors or removal from the United States by the U.S. Department of Homeland Security.  DCS strives to provide the best care and placement for unaccompanied alien children (UAC), who are in federal custody by reason of their immigration status, while taking into account the unique nature of each child’s situation in making placement, case management, and release decisions.  DCS also oversees the Unaccompanied Refugee Minors (URM) program, which connects refugee minors with appropriate foster care services and benefits when they do not have a parent or a relative available and committed to providing for their long-term care.

  • Unaccompanied Children’s Services: This program makes and implements placement decisions in the best interests of UAC to ensure that they are in the least restrictive setting possible while in federal custody.  The majority of UAC are cared for through a network of state licensed ORR-funded care providers, which provide classroom education, mental and medical health services, case management, and socialization/recreation.  ORR/DCS funds programs to provide a continuum of care for children, including foster care, group homes, and residential treatment centers.  The division also coordinates a legal access project assuring that these children have information about their legal rights and receive an individual legal screening to assess their chances of legal relief.  Finally, ORR/DCS provides family reunification services to facilitate safe and timely placement with family members or other qualified sponsors.
  • Unaccompanied Refugee Minors Program: This program ensures that eligible unaccompanied minor populations receive the full range of assistance, care, and services available to all foster children in the state by establishing a legal authority to act in place of the child’s unavailable parent(s).  Our programs encourage reunification of children with their parents or other appropriate adult relatives through family tracing and coordination with local refugee resettlement agencies.  However, if reunification is not possible, each program works to design a case specific permanency plan for each minor or youth in care.  Additional services ORR provides include: indirect financial support for housing, food, clothing, medical care, and other necessities; intensive case management by social workers; independent living skills training; educational supports including educational training vouchers; English language training; career/college counseling and training; mental health services; assistance adjusting immigration status; cultural activities; recreational opportunities; support for social integration; cultural and religious preservation.

Anti-Trafficking in Persons Division
The Division of Anti-Trafficking in Persons (ATIP) helps certify victims of a severe form of trafficking in persons, as defined by the Trafficking Victims Protection Act of 2000.  These individuals are eligible to receive federally funded benefits and services to the same extent as refugees, and can begin to rebuild their lives in the United States.  ATIP is committed to promoting public awareness and assisting in the identification of trafficking victims by educating the public and persons likely to encounter victims.  These organizations or persons may include: social services providers; public health officials; legal organizations; as well as ethnic, faith-based, and community organizations.

ATIP is responsible for the following programs:

Victim Identification and Public Awareness

• Rescue and Restore Campaign: This program is a public awareness campaign that established Rescue and Restore coalitions in 24 cities, regions, and states. These community action groups are comprised of non-governmental organization leaders, academics, students, law enforcement officials, and other key stakeholders who are committed to addressing the problem of human trafficking in their own communities.

• Rescue and Restore Regional Program: This program serves as the focal point for regional public awareness campaign activities and intensification of local outreach to identify victims of human trafficking.  Each Rescue and Restore Regional partner oversees and builds the capacity of a local anti-trafficking network, and sub-awards 60 percent of grant funds to local organizations that identify and work with victims.  By acting as a focal point for regional anti-trafficking efforts, Rescue and Restore Regional partners encourage a cohesive and collaborative approach in the fight against modern-day slavery.

Assistance for Victims of Human Trafficking

  • Certifications and Eligibility Letters: HHS is the sole federal agency authorized to certify foreign adult victims of human trafficking.  Similarly, it is the sole federal agency authorized to make foreign child victims of human trafficking eligible for assistance.  ORR issues all certifications and eligibility letters.  Certification grants adult foreign victims of human trafficking access to federal benefits and services to the same extent as refugees.  Likewise, eligibility letters grant minor foreign victims of trafficking access to federal benefits and services to the same extent as refugees, including placement in the Unaccompanied Refugee Minors program.
  • National Human Trafficking Victim Assistance Program: This program provides funding for comprehensive case management services to foreign victims of trafficking and potential victims seeking HHS certification in any location in the United States.  The grantees provide case management to assist a victim of trafficking to become certified, and other necessary services after certification, through a network of sub-awardees in locations throughout the country.  These grants ensure the provision of case management, referrals, and emergency assistance (such as food, clothing, and shelter) to victims of human trafficking and certain family members.  Grantees help victims gain access to housing, employability services, mental health screening and therapy, medical care, and some legal services, enabling victims to live free of violence and exploitation.
  • National Human Trafficking Resource Center: This program is a national, toll-free hotline for the human trafficking field in the United States.  It is reached by calling 1-888-3737-888 or e-mailing [email protected].  The NHTRC operates around the clock to protect victims of human trafficking.  It provides callers with a range of comprehensive services including: crisis intervention; urgent and non-urgent referrals; tip reporting; anti-trafficking resources; and technical assistance for the anti-trafficking field and those who wish to get involved.  To perform these functions, the NHTRC maintains a national database of organizations and individuals, as well as a library of anti-trafficking resources and materials.

Office of the Director
The Office of the Director responds to overall ORR operations and special projects, including communications and outreach, media relations, and the federal government’s U.S. Repatriation Program.  The Budget, Policy, and Data Analysis (BPDA) team is also located within the Office of the Director, and is responsible for the allocation and tracking of funds for refugee cash and medical assistance, as well as state administrative costs; forecasting and executing ORR’s annual budget; developing regulations and legislative proposals; and routinely interpreting policy.  BPDA also coordinates preparation of the ORR Annual Report to Congress.

2011, POTUS Stopped Syrian Refugees, Security Concerns

Posted on by

The real humanitarian thing to do at this point is fight this war against all enemies and fight to win it. Syrians and the rest of the refugees can go home, where most do have loyalties.

The Obama Administration Stopped Processing Iraq Refugee Requests For 6 Months In 2011

November 18, 2015 By

Although the Obama administration currently refuses to temporarily pause its Syrian refugee resettlement program in the United States, the State Department in 2011 stopped processing Iraq refugee requests for six months after the Federal Bureau of Investigation uncovered evidence that several dozen terrorists from Iraq had infiltrated the United States via the refugee program.

After two terrorists were discovered in Bowling Green, Kentucky, in 2009, the FBI began reviewing reams of evidence taken from improvised explosive devices (IEDs) that had been used against American troops in Iraq. Federal investigators then tried to match fingerprints from those bombs to the fingerprints of individuals who had recently entered the United States as refugees:

An intelligence tip initially led the FBI to Waad Ramadan Alwan, 32, in 2009. The Iraqi had claimed to be a refugee who faced persecution back home — a story that shattered when the FBI found his fingerprints on a cordless phone base that U.S. soldiers dug up in a gravel pile south of Bayji, Iraq on Sept. 1, 2005. The phone base had been wired to unexploded bombs buried in a nearby road.

An ABC News investigation of the flawed U.S. refugee screening system, which was overhauled two years ago, showed that Alwan was mistakenly allowed into the U.S. and resettled in the leafy southern town of Bowling Green, Kentucky, a city of 60,000 which is home to Western Kentucky University and near the Army’s Fort Knox and Fort Campbell. Alwan and another Iraqi refugee, Mohanad Shareef Hammadi, 26, were resettled in Bowling Green even though both had been detained during the war by Iraqi authorities, according to federal prosecutors.

The terrorists were not taken into custody until 2011. Shortly thereafter, the U.S. State Department stopped processing refugee requests from Iraqis for six months in order to review and revamp security screening procedures:

As a result of the Kentucky case, the State Department stopped processing Iraq refugees for six months in 2011, federal officials told ABC News – even for many who had heroically helped U.S. forces as interpreters and intelligence assets. One Iraqi who had aided American troops was assassinated before his refugee application could be processed, because of the immigration delays, two U.S. officials said. In 2011, fewer than 10,000 Iraqis were resettled as refugees in the U.S., half the number from the year before, State Department statistics show.

According to a 2013 report from ABC News, at least one of the Kentucky terrorists passed background and fingerprint checks conducted by the Department of Homeland Security prior to being allowed to enter the United States. Without the fingerprint evidence taken from roadside bombs, which one federal forensic scientist referred to as “a needle in the haystack,” it is unlikely that the two terrorists would ever have been identified and apprehended.

“How did a person who we detained in Iraq — linked to an IED attack, we had his fingerprints in our government system — how did he walk into America in 2009?” asked one former Army general who previously oversaw the U.S. military’s anti-IED efforts.

President Barack Obama has thus far refused bipartisan calls to pause his administration’s Syrian refugee program, which many believe is likely to be exploited by terrorists seeking entry into the United States. The president has not explained how his administration can guarantee that no terrorists will be able to slip into the country by pretending to be refugees, as the Iraqi terrorists captured in Kentucky did in 2009. One of those terrorists, Waad Ramadan Alwan, even came into the United States by way of Syria, where his fingerprints were taken and given to U.S. military intelligence officials.

Obama has also refused to explain how his administration’s security-related pause on processing Iraq refugee requests in 2011 did not “betray our deepest values.”

*** Were we even paying attention last February when POTUS made his declaration on accepting Syrian refugees? What changed between 2011 and earlier this year? The UN? Money? Iran?

WASHINGTON — The Obama administration’s commitment to take in potentially thousands of Syrian refugees is raising national security concerns among law enforcement officials and some congressional Republicans who fear clandestine radicals could slip into the country among the displaced.
The administration has vowed to help those who fled the civil war by providing homes, furniture, English classes and job training in the United States. It says they’ll be subject to intensive screening before entering the country, and that the overwhelming majority are vulnerable women and children.
“These are people I think that if most Americans met them, their instinct would immediately be, ‘We have to help these people,'” Anne Richard, the assistant secretary of state for population, refugees and migration, said in an interview with The Associated Press.
But without reliable intelligence within Syria, some argue that it’s impossible to ensure that someone bent on violence or supporting a militant cause doesn’t come in undetected.
The issue came to the fore at a House Homeland Security Committee hearing earlier this month, when Michael Steinbach, the FBI assistant director for counterterrorism, said the information the intelligence community would normally rely on to properly vet refugees doesn’t exist in a failed country like Syria.
“You have to have information to vet, so the concern in Syria is that we don’t have systems in places on the ground to collect the information,” Steinbach testified.
More than 3.8 million Syrians are believed to have fled their country in the four years since an uprising against President Bashar Assad led to a civil war.
Most who have resettled have traveled to neighboring countries like Lebanon, Jordan and Turkey. But those avenues are strained. Lebanon announced plans last month to impose restrictions on Syrians trying to enter the country, and an international human rights group accused Jordanian authorities in the fall of deporting vulnerable refugees, including wounded men and unaccompanied children, back to Syria.
The United States last year resettled nearly 70,000 refugees from dozens of countries and accepts the majority of all referrals from U.N. refugee programs. More than 500 Syrian refugees are in the U.S., and plans call for adding a few thousand more in the next couple of years.
But aid groups say they’d like to see the U.S. move more quickly to take in more, given the humanitarian crisis in Syria.
“They need countries like the United State that have capacity to host significant numbers to really start to share that burden,” said Anna Greene, a policy and advocacy director at International Rescue Committee, a New York-based humanitarian organization.
As the Obama administration pushes to boost the numbers, three Republican members of Congress — Reps. Peter King of New York, Michael McCaul of Texas and Candice Miller of Michigan — have asked the administration to say how many Syrian refugees it plans to resettle and to provide a timeline and steps to ensure they’re not a security risk. They warned that a weak screening process could become a “backdoor for jihadists.”
When McCaul raised the issue Wednesday with Secretary of State John Kerry, Kerry assured him that the refugees would be subject to “super-vetting” and that if the FBI expressed concerns about someone, that person would not be let in. “We have amazing ways of being able to dig down and dig deep,” Kerry said at a House Foreign Affairs Committee hearing.
The security concerns echo those voiced over the past decade, when large number of Iraqis sought U.S. refuge from that country’s war.
Two Iraqi refugees who entered the United States in 2009 were charged in Kentucky two years later with plotting to send weapons and money to al-Qaida operatives in Iraq. The case raised particular alarm within the intelligence community because one of the men was able to enter the country even though his fingerprints years several earlier had been left on an unexploded bomb in Iraq. In 2011, then-FBI Director Robert Mueller said the FBI was scrutinizing Iraqi refugees already in the U.S. for possible links to al-Qaida’s affiliate in Iraq.
U.S. officials say they’ve since tightened the controls.
The FBI’s Steinbach told Congress that unlike Iraq, where Americans personnel on the ground were able to gather intelligence, there’s no comparable “footprint on the ground in Syria.”
“All of the data sets, the police, the intel services that normally you would go and seek that information, don’t exist,” he said.
State Department officials say refugees are screened more carefully than all other visitors to the United States, checked against all databases maintained by U.S. law enforcement and intelligence agencies and undergo extensive medical checks and fingerprinting. Specially trained officers from the Homeland Security Department conduct overseas, in-person interviews with those seeking refuge. Refugees are far more likely to be victims of violence than criminals themselves.
“I think if we talk about just this faceless mob of people from conflict-ridden lands, it seems very scary,” the State Department’s Richard said. “But if you meet individuals and individual families, you start to understand the very, very human nature of what it means to be a refugee.”

Last May, DHS Warned on Belgium ISIS Cell

Posted on by

UNC L A S S I F I E D / / F O R  O F F I C I A L  US E  O NL Y

UNC L A S S I F I E D / / F O R  O F F I C I A L  US E  O NL Y
(U//FOUO)  Future ISIL Operations in the
West Could Resemble Disrupted Belg  Plot
13 May 2015
Office of Intelligence and Analysis
IA-0 -15
(U)  Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO).  It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552).  It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
13 May 2015
(U//FOUO)  Future ISIL Operations in West Could Resemble Disrupted Belgian Plot
(U//FOUO)  Prepared by the Office of Intelligence and Analysis (I&A).  Coordinated with NPPD, the FBI, and NCTC.  
(U)  Key Judgments
(U//FOUO)  I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West.  We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little
to no warning. 
(U//FOUO)  I&A assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.  
(U//FOUO)  I&A assesses that items recovered by Belgian authorities suggest the group’s plotting may
have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR).  (See Appendix A for details on the importance of SAR reporting.)
(U//FOUO)  I&A assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.  
(U//FOUO)  I&A assesses that facilitation efforts by
the group were likely aided by members’ criminal
background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  
(U//FOUO)  Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.  
(U//FOUO)  Belgian Plot Signals ISIL’s Interest
in Complex Plots Against the West
(U//FOUO)  The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated
(U)  Scope
(U//FOUO)  This Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL).  This Assessment is intended to support the DHS activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.   
(U)  Background
(U)  On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect.  The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operatives—some of whom were returning foreign fighters—possibly targeting police or the public.  The group may have been acting under the direction of a member(s) of ISIL.  There is no publically available information as to whether a specific target was selected.  Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities.  The investigation into this plot remains ongoing.1,2  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 2 of 8
operations in the West.  I&A judges that the threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europe—where several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacks—than in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s
geographic proximity to the conflicts in Syria and Iraq.3,4  While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  I&A notes that small-scale attacks using comparatively less sophisticated tactics—such as the 3 May attempted attack against a
“Draw the Prophet” event in Garland, Texas by
individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social media—could proceed with little to no warning.    
(U//FOUO)  Dispersed Activities and Remote Leadership Possibly Intended to Conceal
Activities 
(U//FOUO)  The group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing information about emerging and ongoing threats.  Even though the group likely planned to attack targets in Belgium, the
investigation into the group’s activities spans several
European countries, including France, Greece, Spain, and the Netherlands, as well countries where there is limited- to-no counterterrorism cooperation with the United States,
such as Syria.  
» (U)  The purported leader of the group, Abdelhamid Abaaoud, directed the operation from a safe house in Athens, Greece using a cell phone, while other group members operated in several other European countries, according to European media reporting citing a senior Belgian counterterrorism official.5,6
» (U)  In addition to the 13 arrests made throughout Belgium, two operatives were arrested in France and police apprehended a cell member in Greece after tracing links to a second safe house in Athens, according to a Belgian news conference and Greek media reporting citing senior police officers.7,8,9
» (U)  Multiple members of the cell appear to have been able to communicate and travel unimpeded across borders to facilitate attack planning.  In addition to directing operatives from the safe house in Athens, Abaaoud boasted he was able to return to
Syria after the Verviers raid despite having international warrants for his arrest, according to an interview featured in the February release of ISIL’s
Dabiq magazine.10 
» (U)  The passport of an identified Dutch national—
possibly associated with the group—who likely traveled to Syria in late 2014 was found at the Verviers safe house, according to Dutch media reporting.11  Dutch officials conducted a search of his parents’ home and confiscated laptops and other media.  As of early April, he was reportedly killed while fighting in Syria, according to unconfirmed Dutch media reporting.12  
(U//FOUO)  Material Acquisition Suggests Attacker’s Potential Tactics and Targets 
(U//FOUO)  Items recovered during searches of
residences affiliated with the cell suggest the group’s
plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers.  There is no publicly available information about the acquisition of these items, but the amounts and types of materials acquired by the group highlights the role of the public and private sector in alerting law enforcement through SARs of attempts to acquire or store a large cache of equipment or chemicals needed to support larger operations.
» (U)  Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash during the raid in Verviers, according to statements made by Belgian government officials.14,15,16  At the time
UNCLASSIFIED
(U)  A picture, from ISIL’s Dabiq magazine, of Abdelhmaid Abaaoud (far right) with the two alleged cell members killed during the January 2015 raid in
Verviers, Belgium.13
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 3 of 8
of the raid, the members of this cell were also searching for an ice machine to cool and transport the TATP, according to European press reporting.17
» (U)  Belgian officials were reportedly concerned that the acquisition of police uniforms and discussion by group members of a Molenbeek police station—where members of the group had reportedly spent time—
suggests that they may have intended to target a police station or to impersonate officers to potentially gain access to a sensitive site. 18,19,20  While there is no confirmation the group was actually going to target police, such an attack would have been consistent with media reports about recent ISIL-linked plots in the West directed at law enforcement and ongoing messaging by ISIL since September 2014.21
(U//FOUO)  Alleged Operational Security Measures Suggest Knowledge of Law Enforcement Methods
(U//FOUO)  The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications.  The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to
deflect scrutiny.
(U//FOUO)  Communications Security.  The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
» (U)  A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for
microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police
officials.23   
» (U)  According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.24    
» (U)  Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious
communications, according to Belgian media reporting.25  
(U//FOUO)  Physical Security.  The group attempted to obscure their operational travel and material acquisition from Belgian officials.
» (U//FOUO)  According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria.  However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.26 
» (U//FOUO)  Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports. 27,28,29  Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning. 30
» (U//FOUO)  The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s
procurement activities and to conceal purchasing patterns.31  Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.
UNCLASSIFIED
(U)   Belgium investigators at scene following the raid in Verviers, Belgium on 15 January 2015.22
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 4 of 8
UNCLASSIFIED
(U)  Figure 1. Map of Group Activities
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 5 of 8
(U//FOUO)  Member’s Criminal Background Likely Aided Planning and Facilitation  
(U//FOUO)  Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious
intentions.
» (U)  At least one alleged cell member, Souhaib el Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.32  The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.33
» (U)  The Belgian police uniforms, large cache of illegal weapons—including Kalashnikov rifles, handguns, ammunition, and materials to make explosives—that were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference.34  Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.35
(U)  Implications
(U//FOUO)  I&A assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small
groups of individuals, raising I&A’s concern that the
involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.*  
* (U//FOUO)  DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.
(U//FOUO)  We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts.  While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 6 of 8
(U//FOUO)  Appendix A: Importance of Suspicious Activity Reporting
(U//FOUO)  Given the range of targets and tactics of ISIL-associated plots since last year, we encourage reporting of suspicious activity to appropriate government authorities and encourage our security, military, and law enforcement partners to remain vigilant.  We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists.  Pre-operational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.
(U)  Indicators
(U//FOUO)  DHS encourages federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities, to include suspicious acquisition of materials and construction of explosive devices.  Some observed activities that may be suspicious include constitutionally protected activity.  These activities should not be reported absent articulable facts and circumstances that support the source agency’s suspicion that
the observed behavior is not innocent, but rather reasonably indicative of criminal activity associated with terrorism.  No single behavioral indicator should be the sole basis for law enforcement action.  The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action.
» (U//FOUO)  New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;
» (U//FOUO)  Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
» (U//FOUO)  Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
» (U//FOUO)  Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
» (U//FOUO)  Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of time—a possible sign of covert stockpiling;
» (U//FOUO)  Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;
» (U//FOUO)  Internet research for target selection, acquisition of technical capabilities, planning, or logistics; » (U//FOUO)  Insisting on paying in cash or using a credit card in another person’s name; » (U//FOUO)  Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in
a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
» (U//FOUO)  Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
» (U//FOUO)  Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
» (U//FOUO)  Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 7 of 8
(U)  Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8
(U)  Source Summary Statement
(U//FOUO)  This Assessment is based on information drawn from a body of unclassified reporting, including open source media reports, public statements of senior foreign government officials, and public accounts of foreign law enforcement investigations from multiple law enforcement agencies.  We have medium confidence in the press reports used in this product, some of which have been corroborated by public statements made by senior foreign law enforcement officials.  
(U)  Report Suspicious Activity
(U)  To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement.  Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action.  For more information on the Nationwide
SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 8 of 8
1 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
2 (U); OSC; EUL2015041773002595; 17 April 2015. 3 (U); OSC; EUL2015021166933318; 11 February 2015. 4 (U); OSC; EUR2015022528575929; 24 February 2015.
5 (U); OSC; EUN2015020948731295; 31 January 2015. 6 (U); OSC; EUL2015020274740312; 1 February 2015. 7 (U); OSC: EUN2015020947629159; 30 January 2015. 8 (U); OSC; EUL2015011674541100; 16 January 2015. 9 (U); OSC; EUL2015021764970267; 17 February 2015. 10 (U); DHS-OS-0316-15; 12 February 2015. 11 (U); OSC; EUL2015012065248183; 19 January 2015.
12 (U); Teen with Connection to Verviers Deceased in Syria; http://www.nieuwsblad.be/cnt/dmf20150403_01614138;
accessed 9 April 2015.
13 (U); DHS-OS-0316-15; 12 February 2015. 14 (U); OSC; EUL2015011674541100; 16 January 2015. 15 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-
belgium-isis-plot/; accessed 20 March 2015.
16 (U); “Belgium Terror Group Planned to Kill Police Officers”; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
17 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
18 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying;
http://www.rtl.be/info/belgique/societe/verviers-voici-ce-que-les-terroristes-presume; accessed 6 April 2015.
19 (U); OSC; EUL2015021764970267; 17 February 2015. 20 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
21 (U); OSC; TRR2014092201178788; 22 September 2014. 22 (U); Belgian Operation Thwarted ‘Major Terrorist Attacks,’ Kills 2 Suspects; http://www.cnn.com/2015/01/15/
world/belgium-anti-terror-operation/; accessed 13 April 2014.
23 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/societe/
    verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
24 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/
societe/verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
25 (U); OSC; EUL2015012064970018; 20 January 2015. 26 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
27 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
28 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
29 (U); OSC; EUN201502094762159; 31 January 2015. 30 (U); Belgian Police Admit Seeking Wrong Man as Vervier Shooutout Jihadists Named; http://www.telegraph.co.uk/
news/worldnews/europe/belgium/11362093/Belgian-police-admit-seeking-wrong-man-as-Vervier-shooutout-jihadists-named.html; accessed 13 April 2015.
31 (U); OSC; EUN201502094762159; 31 January 2015. 32 (U); Terrorist Threat – Dismantled Verviers Terrorist Cell: 4 Suspects Face Council Chamber;
http://www.thebrusselstimes.com/belgium/terrorist-threat-dismantled-verviers-terrorist-cell-4-suspects-face-
council-chamber/; accessed 1 April 2015.
33 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
34 (U); OSC; EUL2015011674541100; 16 January 2015. 35 (U); OSC; EUR2015012167949567; 21 January 2015. 

ISIS Embedded in Urban Areas, Fake Passports

Posted on by

Reuters: Honduras detains 5 Syrians heading for U.S. with stolen Greek passports-police

Honduran authorities have detained five Syrian nationals who were trying to reach the United States using stolen Greek passports, but there are no signs of any links to last week’s attacks in Paris, police said.

 

Check out this interactive graphic on Syrian refugee arrivals in the U.S., by the Reuters Graphics team. http://reut.rs/1OfytDd

‘420 potentially dangerous Islamists live in Germany’

Berlin, Nov 17 (IANS/EFE) Around 43,000 people are part of Islamist circles in Germany and around 420 are considered potentially dangerous, the president of the German Federal Criminal Police Office (or BKA) has said.

In an interview with Die Welt newspaper after the attacks in Paris, Holger Munch recalled that Islamist terrorism attacks European values, with Germany also in its sight.

As he noted, the coordinated work of the security forces has prevented 11 attacks in the country, but Paris has shown that the risk of international terrorism is “high” and that Germany may also be affected.

The jihadists, he explained, are younger than they were a few years ago and radicalized much faster; sometimes they spend a few months or a few weeks until a person decides to travel to Syria.

Many have criminal records behind them and often, before travelling abroad to join the jihadists, come into contact with Salafist groups in Germany.

According to data from the BKA, more than 750 Islamists have left Germany bound for Iraq and Syria and there is information about 70 people who have returned after receiving military training or combat experience.

 

French Prosecutor: 7 Hour Siege 5000 Rounds, Paris

Posted on by

A dead dog too, sadly that was instrumental to the investigation and raid.

Abdelhamid Abaaoud, Top Suspect in Paris Attacks, Not Arrested in Morning Raid

  • NYT: The police stormed the Paris suburb of St.-Denis and arrested eight. At least two people died, including one who blew herself up.
  • The prosecutor said that Abdelhamid Abaaoud, suspected of organizing Friday’s attacks, and another fugitive, Salah Abdeslam, were not among those arrested.
  • Everything we know about the attackers is here.
  • Here are profiles of some of the victims.

Details for Bataclan Attack Found on Cellphone in Paris Trash Can

A cellphone that could belong to one of the attackers was found in a trash can near the Bataclan concert hall in Paris, according to the French publications Le Monde and Mediapart.

Investigators found a detailed plan of the Bataclan assault and a text message sent at 9:42 p.m. on Friday that read, “On est parti on commence.” This can be translated as “Here we go, we’re starting,” or, more literally, “We have left, we’re starting.”

The identities of the sender and the recipient of the text message remained unclear.

Investigators told Le Monde that geolocation services on the phone led them to one of the places the attackers were last seen, in the Paris suburb of Alfortville.

French authorities kill 2, detain 7 terror suspects in violent raid

Here are the latest details related to the French police raid on suspected terrorists in a Paris suburb, as well as the larger fight involving ISIS and the West:

Latest developments:

• Officials have not yet identified the two dead in Wednesday’s raids in Saint-Denis, Paris prosecutor Francois Molins said. Belgian state broadcaster RTBF reported that the woman who blew herself up during that operation is a cousin of Abdelhamid Abaaoud, the suspected ringleader in Friday’s attacks in Paris.

Abaaoud and Salah Abdeslam, who also was allegedly involved in last week’s bloodshed, are not among the seven detained in connection with that Saint-Denis operation, the prosecutor said.

• The Saint-Denis shootout began at 4:20 a.m. local time (10:20 p.m. ET Tuesday) and lasted nearly an hour, according to Molins.

• Three coordinated teams of commandos committed Friday’s Paris attacks, arriving nearly simultaneously at three locations, Molins said. Authorities have been able to identify five of the seven terrorists killed in that bloodshed.

Full story:

For the second time in a week, gunfire and explosions ripped through France on Wednesday — this time in an hours-long ordeal that ended with two terror suspects dead, seven detained, new attacks potentially thwarted and further proof, according to French President Francois Hollande, that his country is “at war” with ISIS.

Authorities zeroed in on a building in the northern Paris suburb of Saint-Denis after picking up phone conversations indicating that a relative of Abdelhamid Abaaoud, the suspected ringleader of last week’s bloody attacks, might be there, a Belgian counterterrorism official said. French police also believed Abaaoud himself was then still in the country, though they didn’t know exactly where.

By late Wednesday, the new question was whether or not he is even alive. Investigators are using DNA to analyze the body parts found in the Saint-Denis building where a female suspect first blew herself up and then French forces used powerful munitions to combat others, which led to one floor of the building collapsing.

Hollande was among those who offered congratulations to French police on the raid. Yet he also stressed that his country’s fight against terrorists, specifically those linked to ISIS, is anything but over. In fact, the violent nature of Wednesday’s raid in Saint-Denis is further proof that “we are at war,” Hollande said.

“What the terrorists were targeting was what France represents. This is what was attacked on the night of November 13th,” he said. “These barbarians targeted France’s diversity. It was the youth of France who were targeted simply because they represent life.”

Given this threat, Hollande said that Wednesday evening he would present legislation to extend France’s state of emergency for three more months — a measure that, among other things, gives authorities greater powers in conducting searches, holding people and dissolving certain groups.

The French President also said he’d appeal to world leaders — including meetings next week with U.S. President Barack Obama and Russian President Vladimir Putin, who have been at odds on what to do in the ISIS stronghold of Syria — to form a wider coalition to go after the savage Islamist extremist group.

“There is no more … divide. There are only men and women of duty,” he said. “… We must destroy this army that menaces the entire world, not just some countries.”

‘We could see the bullets’

As France learned Friday — when a series of coordinated attacks left a trail of horror, sorrow and questions, with 129 dead and hundreds more wounded — terrorists act with savagery on their own schedule.

And those in Saint-Denis were “about to move on some kind of operation” again, police sources told CNN, adding that the Wednesday raid happened “just in time.”

Some 110 police swarmed on the diverse, working-class area that is home to the Stade de France sports stadium — where three suicide bombings took place days earlier. They first went into one apartment that had been under surveillance since Tuesday, a Paris police source said. That raid led them to another apartment on the same street.

The French police met fierce resistance when they entered the building, including the female suicide bomber — who Belgian state broadcaster RTBF claimed was Abaaoud’s cousin. They answered with powerful munitions of their own, a fact that produced piles of rubble interspersed with body parts, according to the Belgian counterterrorism official.

“We could see the bullets,” a woman, who identified herself only as Sabrine, told CNN affiliate France 2 of the drama. “We could feel the building shaking.”

Interior Minister Bernard Cazeneuve said there could end up being more than the two suspected terrorist deaths. As of Wednesday afternoon, seven suspects — including three in one apartment, the person who loaned the apartment to the suspected terrorists and his friend — ended up in custody from this operation alone. Two of them are hospitalized, Interior Ministry spokesman Pierre-Henry Brandet told France Info radio.

Five French officers, meanwhile, were slightly wounded, while a police dog died in the operation, according to police.

Saadana Aymen, a 29-year-old who lives one street down, couldn’t believe what was happening in his neighborhood.

“When you think of Saint-Denis, you don’t think of terrorists,” he told CNN. “I’m shocked! Why would the terrorists pick this neighborhood?”

Phones offer clues

Yet Saint-Denis wasn’t the only place where French authorities fanned out Tuesday night into Wednesday, as part of their security clampdown.

The Interior Ministry announced in a statement that 118 searches led to the detention of at least 25 people, the confiscation of 34 weapons and the discovery of illicit drugs in 16 instances. This is on top of hundreds of similar operations conducted in recent days, which have resulted in 64 people being held and 118 put under house arrest.

Authorities have not yet laid out what connection any of these arrests have to Friday’s attacks. Yet counterterrorism and intelligence officials say that investigators have uncovered what could be a big break: cell phones believed to belong to the attackers.

According to the officials, one of the phones contained a message, sent sometime before the Friday attacks began, to the effect of: OK, we’re ready.

But cracking into their communication won’t be easy.

Investigators have found encrypted apps on the phones, which appear to have left no trace of messages or any indication of who would have been receiving them, according to officials briefed on the French investigation.

‘These are not regular people’

Seven attackers died during Friday night’s wave of violence, and an international arrest warrant is out for one suspect, Salah Abdeslam, a 26-year-old Frenchman. The identity of the possible ninth suspect, seen in a video that shows two gunmen inside a black car and perhaps a third person driving the vehicle, is unknown.

Mohamed Abdeslam has urged his younger brother Salah, who was stopped but then let go en route to the Belgian border hours after the attacks, to turn himself into authorities. He acknowledged noticing Salah and another brother — 31-year-old Ibrahim, who is among the seven terrorists killed — had been adopting more radical views, though that didn’t mean the family isn’t shocked.

“My brother who participated in this terrorist act must have been psychologically ready to commit such an act. These are not regular people,” he told CNN.

“You cannot have the slightest doubt that they have been prepared, that they must not leave any trace which would cause suspicion that they might do such things. And even if you saw them every day, their behavior was quite normal.”

Official: Belgian authorities lost track of 2 suspects

Both Salah Abdeslam and Ibrahim were known to authorities: Belgian prosecutor Eric Van Der Sypt told CNN’s Ivan Watson police questioned the Abdeslam brothers in February. The brothers were released, the federal prosecutor said, after they denied wanting to go to Syria.

And Salah Abdeslam and Abaaoud served time together in a Belgian prison in 2011, when the former spent a month for an alleged theft, a Belgian federal prosecutor said.

Belgian authorities believe Abaaoud has spent previous months in Raqqa, the Syrian city that’s now the de facto capital of the Islamic State, or ISIS, a counterrrorism official in that European nation said. There, in Syria, Abaaoud is thought to have worked with several senior French figures in ISIS — members of the so-called Artigat network including Sabri Essid and Fabien Clain, whose voice can be heard on the claim of responsibility for the Paris attacks — to plot a series of attacks in France.

Already, Essid and Clain have been traced to an April plot to attack a Paris church and the August armed assault on an Amsterdam-to-Paris train that was thwarted by three Americans.

As to those behind the latest violence, Belgian authorities didn’t even know Abaaoud was back in Europe, according to the counterterrorism official. They’d also lost track of Salah Abdeslam.

And, the senior Belgian official said, the bombmaker who made the suicide vests used in Paris is also thought to still be at large.

What’s next for ISIS?

ISIS was born in Iraq and blossomed in Syria, taking advantage of the power vacuum from that country’s chaotic, years-long civil war. In the process, the militant group employed bold, ruthless and sometimes sadistic tactics — as evidenced by the taking of women and girls as sex slaves, broadcasting the beheading of journalists and aid workers, destroying centuries-old historic artifacts and massacring those who don’t subscribe to its twisted, extreme interpretation of Islam.

The group has managed to take over vast swaths of Iraq and Syria in this campaign. But it’s not content to stop there.

Egypt, Libya, Yemen, Lebanon and other nations have all been sites of ISIS-claimed attacks in recent months. The militant group has also boasted about bloodshed inside Europe, including January’s massacre on the Paris offices of the satirical magazine Charlie Hebdo.

While some have faulted world leaders for not stepping up sooner, there has been a more concerted effort of late. The United States conducted airstrikes for months, which U.S. Army Col. Steven Warren estimated have killed at least one mid- to high-level ISIS figure every day since May. More recently, Russia has stepped into the fray, in part, to support its longtime ally Bashar al-Assad, Syria’s embattled President.

Then there’s Turkey, whose involvement has been complicated by the fact that its longtime adversaries, the Kurds, have been fighting against ISIS. On Wednesday, the semi-official Anadolu news agency reported that Turkish police had detained eight ISIS-linked suspects who’d arrived at an Istanbul airport from Casablanca. The eight Moroccans said they had booked a hotel in Turkey and were preparing to head to Germany — via Greece, Serbia and Hungary — the report added, pointing to a document — seized by police — that detailed the travel route.

France has been part of the U.S.-led coalition fighting ISIS for months. But it has enhanced its role — symbolically and in practice — in the wake of the latest Paris attacks. And Hollande says that the arrival of the aircraft carrier Charles de Gaulle within striking distance of Syria will triple France’s capacity to conduct airstrikes.

And, despite their differing stances on Syria’s future and other matters, Russia’s armed forces are ready to organize joint military operations with the French navy “to combat terrorists in Syria,” Russia’s state-run TASS news agency reported, citing army official Andrey Kartapolov.