Recorded: Turkey Warning to Russian Pilots

al-Arabiya: A civilian pilot who was in the sky when the Turkish military issued a warning to, and ultimately shot down, a Russian fighter jet has provided Al Arabiya News with a recording that proves the Turkish authorities issued several warnings to the plane.

The pilot, who was flying a Middle East Airlines (MEA) flight from Beirut’s Rafic Hariri International Airport to a Gulf country at approximately 9:00 a.m. (local Lebanese time) yesterday also verified the authenticity of a similar recording which was uploaded on the information sharing website LiveLeak which many international media outlets have carried.

“I confirm the authenticity of their recording, I heard these exact same warnings over and over again and the part I recorded on my phone was actually towards the end when I felt the matter was getting serious,” the Lebanese aviator told Al Arabiya News on the condition of anonymity.

Listen to the Turkish officer issuing repeated warnings

The version of the recording obtained by Al Arabiya News from this pilot clearly proves that Turkish authorities were issuing repeated warnings to the Russian aircraft that they “were approaching Turkish air space”.

“Unknown air traffic position onto Humeymim 020, redirect to 26 miles. This is Turkish Air Force speaking – en guard. You are approaching Turkish airspace. Change your heading south immediately.,” the Turkish officer was repeatedly saying.

There was however no response from the Russian side, which Al Arabiya’s source says has been the case for weeks.

The MEA pilot explained that from what he gathers, Tuesday’s incident was not the first as he had heard similar warnings over his radio transmission for the past month.

“I heard similar warnings two or three times a week, on every flight I took for the past month.

“What was different this time is that the Turkish officer was shouting and seemed tense, while the warnings were much calmer in previous times… this is why I knew something was going to happen,” he added.

No-fly zone?

MEA is the flag carrier of Lebanon and is one of the world’s few remaining airlines which still fly over neighboring Syria – a country that has been engulfed in a civil war since the end of 2011.

When asked if yesterday’s Russian-Turkish standoff caused any harm or potential threat to his flight, or to the safety of his passengers, the MEA pilot said the plane had already passed Lebanon’s southern border and as such was already far away from where the incident occurred.

But he added that flying over Syria in general wasn’t a safe choice and that a number of his co-workers had voiced their concerns.

“But the decision to fly over Syria is a political one imposed by the (Lebanese) government, not a health and safety call that we (the airlines) can decide on as we normally would,” he warned.

Lebanon suffers from strong Syrian presence and interference ever since its own civil war erupted in 1975. Even after the Syrian troops withdrew in 2005, Syria is said to have still had much influence over Lebanese politics via its allies, namely Hezbollah militias which are in control of security at Beirut’s airport.

Infographic: Turkey downs warplane

Security analysts react

Security analysts told Al Arabiya News that debating whether Turkey was in the right or wrong of taking aggressive actions did not matter currently.

Director of Intelligence and Gulf expert at the Levantine Group Miriam Goldman the debate over the rights and wrongs of Turkey’s action were now irrelevant. She added, ‘what was done, was done.’

She added: “Debating right versus wrong is not what matters right now.”

From my point of view it seems like ‘enough is enough’ from Turkey’s standpoint.”

Turkey, a NATO alliance member, had previously warned other countries against violating its airspace. In October, NATO released a joint statement on behalf of Turkey saying: “Allies strongly protest these violations of Turkish sovereign airspace, and condemn these incursions into and violations of NATO airspace. Allies also note the extreme danger of such irresponsible behavior. They call on the Russian Federation to cease and desist, and immediately explain these violations.”

“Allies call on the Russian side to take all necessary measures to ensure that such violations do not take place in the future,” the statement added.

“Turkey has indeed warned previous planes against entering its airspace on multiple occasions. This might have been a situation where Turkey simply felt they had warned them so much and now had to take action after being ignored,” Goldman said.

Russian denials

While both Turkey and Russia have been trading blows with one another since Tuesday’s attack, analysts say a formal investigation is needed to fully understand what actions would be taken next.

“It is not quite clear what exactly Turkey had asked the Russian plane what not to do, and how much warning they actually gave. If the jet was flying at several hundred miles an hour and was issued a warning from Turkey and given only gave a few seconds for a response, is that enough time? It’s still unclear,” British defense journalist Tim Ripley told Al Arabiya News.

“There are lots of procedures for countries to protect their airspace, many of them don’t involve shooting down planes,” he added.

On Wednesday night, Russia’s news agency said that the surviving pilot rescued by Syrian forces said that they did not receive any warnings or communications from Turkey.

Russian Minister of Foreign Affairs Sergey Lavrov also accused Turkey saying: “Downing of Russian jet by turkey was a planned act.”

CriticallThreats.org:   Turkey’s decision to fire on a Russian Su-24 that briefly violated its airspace resulted from more than concerns about the integrity of its borders.  Russian airstrikes have been helping Assad, Hezbollah, and Iranian proxy forces advance in Turkmen areas near the Turkish border in recent days.  Turkey claims that those airstrikes hit Turkmen villages. Turkey regards the Turkmen of Iraq and Syria as kin, works to protect and advance their interests, and tries to defend them.  The Turkish shoot-down is probably intended to deter Putin from continuing to provide air support to Assad operations against them, among other things.

The incident highlights the grand strategic implications of American policy in Syria, moreover.  The West, led by France, has been drifting in the direction of cooperating if not allying with Putin, whom many wrongly believe is in Syria to fight ISIS. That drift empowers Putin and overlooks the larger objectives of Putin’s maneuvers, as Leon Aron points out.  Putin aims to disrupt NATO fundamentally as part of a larger effort to recoup Russia’s losses following the collapse of the Soviet Union.  He has been deliberately and aggressively prodding Turkey from his airbase in Syria, just as he has been consistently violating the airspace of US allies in the Baltics and US partners in Scandinavia.  He is counting on Washington to remain so myopically focused on the fight against ISIS that it overlooks and tacitly accepts these assaults on the Western alliance structure.  It would be an enormous mistake if we did so.

Russia Threatening Scotland?

Britain calls in French to hunt Russian sub lurking off Scotland

A Royal Navy frigate, HMS Sutherland, and a hunter killer submarine have also been sent on the search

Telegraph: French patrol planes are scouring the seas off Scotland for a Russian submarine after Britain was forced to call on allies for help because it has scrapped its own sub-hunting aircraft.

A French Atlantique 2 maritime patrol plane has been searching for the submarine for at least 10 days, since the vessel was detected north of Scotland.

Britain scrapped its own Nimrod sub-hunting aircraft in 2010

A Royal Navy frigate, HMS Sutherland, and a hunter killer submarine have also been sent on the search, amid fears the Russian boat could be trying to spy on a Trident nuclear deterrent sub.

HMS SutherlandHMS Sutherland has been called into the hunt  Photo: MoD

Britain scrapped its own Nimrod maritime patrol aircraft after the cost cutting 2010 defence review, leading to warnings from defence chiefs that the country would be left reliant on others for aircraft to search its own waters.

Admirals have argued that filling the gap is a priority for the Government’s defence review which will be unveiled on Monday. More here.

*** ‘Allied’ Aircraft Hunt Russian Sub Off Scotland

SkyNews: French patrol aircraft are reportedly among those helping with the search from RAF Lossiemouth.

Aircraft based at an RAF base are conducting “activity” off Scotland in response to reports a Russian submarine has been seen nearby, the Ministry of Defence has confirmed.

It is understood that a Royal Navy frigate and a submarine are also involved in the hunt.

It comes days after RAF Typhoons were forced to intercept Russian Tu-160 Blackjack aircraft that strayed into the vicinity of UK airspace.

The Sun on Sunday reported that a French patrol aircraft was carrying out the search as the UK no longer has any specialist sub-hunting aircraft.

Britain scrapped the RAF’s Nimrods with search capability in 2010 after the Strategic Defence Services Review.

The Telegraph reported that two French Atlantique 2 maritime patrol planes and a Canadian plane were now operating out of RAF Lossiemouth, about 37 miles (60km) east of Inverness.

The MoD admitted that allied planes were operating from the base but refused to comment on naval manoeuvres.

“We can confirm that allied maritime patrol aircraft based at RAF Lossiemouth for a limited period are conducting activity with the Royal Navy,” a statement said.

Soldiers

00:00/02:11

Video: More British Troops To Baltics

“We do not discuss the detail of maritime operations.”

The search comes as the Prime Minister is due to announce a large investment in resources for the military, which has undergone several years of cuts.

One of the commitments is to buy nine Boeing P8 Poseidon maritime patrol aircraft which will be capable of hunting submarines.

Norwegian jet in near-miss with Russian plane

00:00/00:20

Video: Pilot’s Shock At Close Call

Last year, the Ministry of Defence faced embarrassment when it emerged it had to seek the help of the US, France and Canada when trying to find another Russian submarine spotted off the west coast of Scotland.

At that time it was thought the Russian vessel was possibly tracking UK nuclear submarine movements from the Clyde.

Russian anti-submarine vessel Severomorsk. Pic US Navy

00:00/01:56

Video: Russian Naval Drills In The Channel

Europe Warned Months Ago to Plug the Border Holes

The United States had better take a reality check especially when it comes to visa waiver countries, vacation visas and student visas. Those are easier to obtain that any refugee status.

EU border agency warned of migrant terror threat 18 months ago – but nothing was done

After years of inaction, sources warn it will take “months, if not years” to plug holes in Europe’s sieve-like borders.

 Between France and Belgium

 

By , Europe Editor and Matthew Holehouse in Brussels

3:51PM GMT 21 Nov 2015

TheTelegraph: Frontex, the European border agency warned more than 18 months ago that radicalised European jihadis could exploit the migrant crisis in order to return to Europe and commit terrorism, but systematic checks on migrants only began last Friday, The Sunday Telegraph can reveal.

The failure of Europe’s border bureaucracy to respond to the terror threat emerged as security sources told The Sunday Telegraph that it will still be “months, even years” before Europe’s borders are fully capable of screening arrivals.

Frontex’s own risk assessment for April 2014 said that the numbers of foreign fighters travelling to Syria and Iraq for jihad had “risen threefold”, with some would-be fighters as young 15 years old.

The report noted that EU representatives were “increasingly discussing ways” to monitor and prevent young people moving to Syria, while clearly acknowledging that the fighters could return to Europe “ideologically and militarily trained, thus posing a terrorist threat to societies.”

A Frontex helicopter flies over an overcrowded raft with refugees and migrants approaching the shores of the Greek island of LesbosA Frontex helicopter flies over an overcrowded raft with refugees and migrants approaching the shores of the Greek island of Lesbos  Photo: REUTERS/Alkis Konstantinidis

“Overall, there is an underlying threat of terrorism-related travel movements especially due to the appeal of the Syrian conflict to both idealist and radicalised youths. It is possible that foreign fighters use irregular migration routes and/or facilitation networks (irrespective of whether this is recommended by terrorist structures or not), especially when the associated risks and costs are perceived as low in comparison to legal travel options,” the report said.

 

“It will take many months – and realistically years – before we screen everyone entering Europe.”
Security source to Sunday Telegraph

The cost of inaction over securing Europe’s external borders were displayed to devastating effect this week, when it emerged that Abdelhamid Abaaoud, the mastermind behind the Paris attacks, had slipped into France unchecked – via Greece – without setting off alarms.

He had previously joked in the Islamic State magazine, Dabiq, how he had once been stopped by Belgian police but not arrested.

The inability of Europe to protect its borders has been blamed on a combination of a lack of resources in poorer members like Greece, Romania and Bulgaria and privacy concerns that have stalled necessary legislation in the European Parliament.

Mohamad Nouv Khanji, a Syrian doctor waits to register with the police in refugee center in the southern Serbian town of Presevo. Khanji traveled with his passport, but the EU border security agency Frontex says most migrants enter Europe with no valid documents. In a growing number of cases, they carry fake IDs as they pretend to be Syrian to improve their asylum chances. That also has raised fears of Islamic extremists entering Europe with false documents. Mohamad Nouv Khanji, a Syrian doctor waits to register with the police in refugee center in the southern Serbian town of Presevo. Khanji traveled with his passport, but the EU border security agency Frontex says most migrants enter Europe with no valid documents.   Photo: AP/Darko Vojinovic

Timothy Kirkhope, a Tory MEP and former immigration minister, blamed “political correctness” and the view that “people should be allowed to go anywhere they like” for the failure to adequately stand up Frontex.

“The external border has to be protected, and if the Greeks and Italians can’t do it we have to beef up Frontex. We’ve got to put the money in,” he added. “I’ve been pressing them to get on this: to not let anyone go anywhere without being processed.”

 

“Frontex has no access to operational intelligence,’
Fabrice Leggeri, the executive director of Frontex

In a sign of the glacial rate of progress, the same warnings on the potential security risk posed by migrant were repeated almost word-for-word in the 2015 version of the Frontex report.

As recently as September Fabrice Leggeri, the executive director of Frontex, admitted to a House of Lords committee that Frontex had “no access to intelligence” since it was an EU agency.

Mr Leggeri said that Frontex could find “no evidence” that potential terrorists had used migrant routes to cross back into the EU, but was forced to admit that this was probably because it was not connected with anti-terror databases.

A Frontex helicopter flies over refugees and migrants seen on a beach, moments after arriving on a dinghy on the Greek island of LesbosA Frontex helicopter flies over refugees and migrants seen on a beach, moments after arriving on a dinghy on the Greek island of Lesbos  Photo: REUTERS/Alkis Konstantinidis

“FRONTEX, as an EU agency, has no access to this kind of operational intelligence,’ he admitted, “This may be why we cannot trace evidence of people who might be involved in terrorist activities.”

France has been demanding tough new controls ever since last January’s terror attacks on the offices of the satirical magazine, Charlie Hebdo, which were finally agreed to a meeting of EU home ministers in Brussels last week.

These include that European passenger name records (PNR) data should be collected and available for scrutiny by intelligence agencies, and that EU citizens should also be subjected to “systematic” checks when re-entering Europe.

However, senior officials have admitted to The Sunday Telegraph that it will take “months, if not years” to secure the EU borders, even as richer EU nations were offering to send small ‘hit squads’ to plug the most obvious gaps in Bulgaria, Romania and Greece.

“This kind of capacity cannot be stood up overnight,” said the source close to the discussions over securing Europe’s borders, “it will take many months – and realistically years – before we really do screen everyone entering Europe against databases of known terrorists and criminals.”

The scale of challenge was revealed in the official communique from the EU Home Ministers meeting, that admitted that many EU border posts still required “electronic connection” to relevant Interpol databases.

As a sign of the depth of concern, Dutch officials this week even floated the idea of a “mini-Schengen”, that would dramatically cut Europe’s 26-member open-frontier zone, taking it back to its original core of group of Germany, Austria, Belgium, the Netherlands and Luxembourg.

Germany and the European Commission have rejected the idea, arguing the answer must be to focus on fixing Schengen as it currently exists, perhaps even by creating an EU-wide intelligence agency, an idea that was quickly shot down by member states.

Even before the Paris attacks, Donald Tusk, the European Council president had acknowledged that the EU was in a “race against time” to stop the collapse of Schengen. “The clock is ticking, we are under pressure, we need to act fast,” he said.

In the meantime, Europe remains at risk of further terror attacks that analysts warn could shatter confidence in a Schengen free-movement system whose credibility has already been seriously damaged by two major terror attacks on Paris in the space of nine months.

Carsten Nickel, Europe analyst with Teneo Intelligence, compared the existential nature of the Schengen crisis with that of the Euro crisis earlier this year, but warned that the security issues would be even harder to fix at a European level.

“The reality is that it is going to take a while to build up the administrative and physical capabilities required to protect Europe’s external borders,” he said.

“As with the Eurozone crisis, there is a logic to creating a centralized, supra-national institutions – like, say in the case of the Eurozone, the ECB – to tackle the problem; but when it comes to security it is just not clear there is the same administrative and political capacity to deliver,” he said.

2011, POTUS Stopped Syrian Refugees, Security Concerns

The real humanitarian thing to do at this point is fight this war against all enemies and fight to win it. Syrians and the rest of the refugees can go home, where most do have loyalties.

The Obama Administration Stopped Processing Iraq Refugee Requests For 6 Months In 2011

Although the Obama administration currently refuses to temporarily pause its Syrian refugee resettlement program in the United States, the State Department in 2011 stopped processing Iraq refugee requests for six months after the Federal Bureau of Investigation uncovered evidence that several dozen terrorists from Iraq had infiltrated the United States via the refugee program.

After two terrorists were discovered in Bowling Green, Kentucky, in 2009, the FBI began reviewing reams of evidence taken from improvised explosive devices (IEDs) that had been used against American troops in Iraq. Federal investigators then tried to match fingerprints from those bombs to the fingerprints of individuals who had recently entered the United States as refugees:

An intelligence tip initially led the FBI to Waad Ramadan Alwan, 32, in 2009. The Iraqi had claimed to be a refugee who faced persecution back home — a story that shattered when the FBI found his fingerprints on a cordless phone base that U.S. soldiers dug up in a gravel pile south of Bayji, Iraq on Sept. 1, 2005. The phone base had been wired to unexploded bombs buried in a nearby road.

An ABC News investigation of the flawed U.S. refugee screening system, which was overhauled two years ago, showed that Alwan was mistakenly allowed into the U.S. and resettled in the leafy southern town of Bowling Green, Kentucky, a city of 60,000 which is home to Western Kentucky University and near the Army’s Fort Knox and Fort Campbell. Alwan and another Iraqi refugee, Mohanad Shareef Hammadi, 26, were resettled in Bowling Green even though both had been detained during the war by Iraqi authorities, according to federal prosecutors.

The terrorists were not taken into custody until 2011. Shortly thereafter, the U.S. State Department stopped processing refugee requests from Iraqis for six months in order to review and revamp security screening procedures:

As a result of the Kentucky case, the State Department stopped processing Iraq refugees for six months in 2011, federal officials told ABC News – even for many who had heroically helped U.S. forces as interpreters and intelligence assets. One Iraqi who had aided American troops was assassinated before his refugee application could be processed, because of the immigration delays, two U.S. officials said. In 2011, fewer than 10,000 Iraqis were resettled as refugees in the U.S., half the number from the year before, State Department statistics show.

According to a 2013 report from ABC News, at least one of the Kentucky terrorists passed background and fingerprint checks conducted by the Department of Homeland Security prior to being allowed to enter the United States. Without the fingerprint evidence taken from roadside bombs, which one federal forensic scientist referred to as “a needle in the haystack,” it is unlikely that the two terrorists would ever have been identified and apprehended.

“How did a person who we detained in Iraq — linked to an IED attack, we had his fingerprints in our government system — how did he walk into America in 2009?” asked one former Army general who previously oversaw the U.S. military’s anti-IED efforts.

President Barack Obama has thus far refused bipartisan calls to pause his administration’s Syrian refugee program, which many believe is likely to be exploited by terrorists seeking entry into the United States. The president has not explained how his administration can guarantee that no terrorists will be able to slip into the country by pretending to be refugees, as the Iraqi terrorists captured in Kentucky did in 2009. One of those terrorists, Waad Ramadan Alwan, even came into the United States by way of Syria, where his fingerprints were taken and given to U.S. military intelligence officials.

Obama has also refused to explain how his administration’s security-related pause on processing Iraq refugee requests in 2011 did not “betray our deepest values.”

*** Were we even paying attention last February when POTUS made his declaration on accepting Syrian refugees? What changed between 2011 and earlier this year? The UN? Money? Iran?

WASHINGTON — The Obama administration’s commitment to take in potentially thousands of Syrian refugees is raising national security concerns among law enforcement officials and some congressional Republicans who fear clandestine radicals could slip into the country among the displaced.
The administration has vowed to help those who fled the civil war by providing homes, furniture, English classes and job training in the United States. It says they’ll be subject to intensive screening before entering the country, and that the overwhelming majority are vulnerable women and children.
“These are people I think that if most Americans met them, their instinct would immediately be, ‘We have to help these people,'” Anne Richard, the assistant secretary of state for population, refugees and migration, said in an interview with The Associated Press.
But without reliable intelligence within Syria, some argue that it’s impossible to ensure that someone bent on violence or supporting a militant cause doesn’t come in undetected.
The issue came to the fore at a House Homeland Security Committee hearing earlier this month, when Michael Steinbach, the FBI assistant director for counterterrorism, said the information the intelligence community would normally rely on to properly vet refugees doesn’t exist in a failed country like Syria.
“You have to have information to vet, so the concern in Syria is that we don’t have systems in places on the ground to collect the information,” Steinbach testified.
More than 3.8 million Syrians are believed to have fled their country in the four years since an uprising against President Bashar Assad led to a civil war.
Most who have resettled have traveled to neighboring countries like Lebanon, Jordan and Turkey. But those avenues are strained. Lebanon announced plans last month to impose restrictions on Syrians trying to enter the country, and an international human rights group accused Jordanian authorities in the fall of deporting vulnerable refugees, including wounded men and unaccompanied children, back to Syria.
The United States last year resettled nearly 70,000 refugees from dozens of countries and accepts the majority of all referrals from U.N. refugee programs. More than 500 Syrian refugees are in the U.S., and plans call for adding a few thousand more in the next couple of years.
But aid groups say they’d like to see the U.S. move more quickly to take in more, given the humanitarian crisis in Syria.
“They need countries like the United State that have capacity to host significant numbers to really start to share that burden,” said Anna Greene, a policy and advocacy director at International Rescue Committee, a New York-based humanitarian organization.
As the Obama administration pushes to boost the numbers, three Republican members of Congress — Reps. Peter King of New York, Michael McCaul of Texas and Candice Miller of Michigan — have asked the administration to say how many Syrian refugees it plans to resettle and to provide a timeline and steps to ensure they’re not a security risk. They warned that a weak screening process could become a “backdoor for jihadists.”
When McCaul raised the issue Wednesday with Secretary of State John Kerry, Kerry assured him that the refugees would be subject to “super-vetting” and that if the FBI expressed concerns about someone, that person would not be let in. “We have amazing ways of being able to dig down and dig deep,” Kerry said at a House Foreign Affairs Committee hearing.
The security concerns echo those voiced over the past decade, when large number of Iraqis sought U.S. refuge from that country’s war.
Two Iraqi refugees who entered the United States in 2009 were charged in Kentucky two years later with plotting to send weapons and money to al-Qaida operatives in Iraq. The case raised particular alarm within the intelligence community because one of the men was able to enter the country even though his fingerprints years several earlier had been left on an unexploded bomb in Iraq. In 2011, then-FBI Director Robert Mueller said the FBI was scrutinizing Iraqi refugees already in the U.S. for possible links to al-Qaida’s affiliate in Iraq.
U.S. officials say they’ve since tightened the controls.
The FBI’s Steinbach told Congress that unlike Iraq, where Americans personnel on the ground were able to gather intelligence, there’s no comparable “footprint on the ground in Syria.”
“All of the data sets, the police, the intel services that normally you would go and seek that information, don’t exist,” he said.
State Department officials say refugees are screened more carefully than all other visitors to the United States, checked against all databases maintained by U.S. law enforcement and intelligence agencies and undergo extensive medical checks and fingerprinting. Specially trained officers from the Homeland Security Department conduct overseas, in-person interviews with those seeking refuge. Refugees are far more likely to be victims of violence than criminals themselves.
“I think if we talk about just this faceless mob of people from conflict-ridden lands, it seems very scary,” the State Department’s Richard said. “But if you meet individuals and individual families, you start to understand the very, very human nature of what it means to be a refugee.”

Last May, DHS Warned on Belgium ISIS Cell

UNC L A S S I F I E D / / F O R  O F F I C I A L  US E  O NL Y

IA-0 -15
(U)  Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO).  It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552).  It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
13 May 2015
(U//FOUO)  Future ISIL Operations in West Could Resemble Disrupted Belgian Plot
(U//FOUO)  Prepared by the Office of Intelligence and Analysis (I&A).  Coordinated with NPPD, the FBI, and NCTC.  
(U)  Key Judgments
(U//FOUO)  I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West.  We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little
to no warning. 
(U//FOUO)  I&A assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.  
(U//FOUO)  I&A assesses that items recovered by Belgian authorities suggest the group’s plotting may
have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR).  (See Appendix A for details on the importance of SAR reporting.)
(U//FOUO)  I&A assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.  
(U//FOUO)  I&A assesses that facilitation efforts by
the group were likely aided by members’ criminal
background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  
(U//FOUO)  Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.  
(U//FOUO)  Belgian Plot Signals ISIL’s Interest
in Complex Plots Against the West
(U//FOUO)  The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated
(U)  Scope
(U//FOUO)  This Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL).  This Assessment is intended to support the DHS activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.   
(U)  Background
(U)  On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect.  The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operativessome of whom were returning foreign fighterspossibly targeting police or the public.  The group may have been acting under the direction of a member(s) of ISIL.  There is no publically available information as to whether a specific target was selected.  Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities.  The investigation into this plot remains ongoing.1,2  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 2 of 8
operations in the West.  I&A judges that the threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europewhere several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacksthan in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s
geographic proximity to the conflicts in Syria and Iraq.3,4  While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  I&A notes that small-scale attacks using comparatively less sophisticated tacticssuch as the 3 May attempted attack against a
“Draw the Prophet” event in Garland, Texas by
individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social mediacould proceed with little to no warning.    
(U//FOUO)  Dispersed Activities and Remote Leadership Possibly Intended to Conceal
Activities 
(U//FOUO)  The group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing information about emerging and ongoing threats.  Even though the group likely planned to attack targets in Belgium, the
investigation into the group’s activities spans several
European countries, including France, Greece, Spain, and the Netherlands, as well countries where there is limited- to-no counterterrorism cooperation with the United States,
such as Syria.  
» (U)  The purported leader of the group, Abdelhamid Abaaoud, directed the operation from a safe house in Athens, Greece using a cell phone, while other group members operated in several other European countries, according to European media reporting citing a senior Belgian counterterrorism official.5,6
» (U)  In addition to the 13 arrests made throughout Belgium, two operatives were arrested in France and police apprehended a cell member in Greece after tracing links to a second safe house in Athens, according to a Belgian news conference and Greek media reporting citing senior police officers.7,8,9
» (U)  Multiple members of the cell appear to have been able to communicate and travel unimpeded across borders to facilitate attack planning.  In addition to directing operatives from the safe house in Athens, Abaaoud boasted he was able to return to
Syria after the Verviers raid despite having international warrants for his arrest, according to an interview featured in the February release of ISIL’s
Dabiq magazine.10 
» (U)  The passport of an identified Dutch national
possibly associated with the groupwho likely traveled to Syria in late 2014 was found at the Verviers safe house, according to Dutch media reporting.11  Dutch officials conducted a search of his parents’ home and confiscated laptops and other media.  As of early April, he was reportedly killed while fighting in Syria, according to unconfirmed Dutch media reporting.12  
(U//FOUO)  Material Acquisition Suggests Attacker’s Potential Tactics and Targets 
(U//FOUO)  Items recovered during searches of
residences affiliated with the cell suggest the group’s
plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers.  There is no publicly available information about the acquisition of these items, but the amounts and types of materials acquired by the group highlights the role of the public and private sector in alerting law enforcement through SARs of attempts to acquire or store a large cache of equipment or chemicals needed to support larger operations.
» (U)  Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash during the raid in Verviers, according to statements made by Belgian government officials.14,15,16  At the time
UNCLASSIFIED
(U)  A picture, from ISIL’s Dabiq magazine, of Abdelhmaid Abaaoud (far right) with the two alleged cell members killed during the January 2015 raid in
Verviers, Belgium.13
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 3 of 8
of the raid, the members of this cell were also searching for an ice machine to cool and transport the TATP, according to European press reporting.17
» (U)  Belgian officials were reportedly concerned that the acquisition of police uniforms and discussion by group members of a Molenbeek police stationwhere members of the group had reportedly spent time
suggests that they may have intended to target a police station or to impersonate officers to potentially gain access to a sensitive site. 18,19,20  While there is no confirmation the group was actually going to target police, such an attack would have been consistent with media reports about recent ISIL-linked plots in the West directed at law enforcement and ongoing messaging by ISIL since September 2014.21
(U//FOUO)  Alleged Operational Security Measures Suggest Knowledge of Law Enforcement Methods
(U//FOUO)  The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications.  The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to
deflect scrutiny.
(U//FOUO)  Communications Security.  The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
» (U)  A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for
microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police
officials.23   
» (U)  According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.24    
» (U)  Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious
communications, according to Belgian media reporting.25  
(U//FOUO)  Physical Security.  The group attempted to obscure their operational travel and material acquisition from Belgian officials.
» (U//FOUO)  According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria.  However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.26 
» (U//FOUO)  Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports. 27,28,29  Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning. 30
» (U//FOUO)  The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s
procurement activities and to conceal purchasing patterns.31  Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.
UNCLASSIFIED
(U)   Belgium investigators at scene following the raid in Verviers, Belgium on 15 January 2015.22
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 4 of 8
UNCLASSIFIED
(U)  Figure 1. Map of Group Activities
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 5 of 8
(U//FOUO)  Member’s Criminal Background Likely Aided Planning and Facilitation  
(U//FOUO)  Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.  The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious
intentions.
» (U)  At least one alleged cell member, Souhaib el Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.32  The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.33
» (U)  The Belgian police uniforms, large cache of illegal weaponsincluding Kalashnikov rifles, handguns, ammunition, and materials to make explosivesthat were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference.34  Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.35
(U)  Implications
(U//FOUO)  I&A assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small
groups of individuals, raising I&A’s concern that the
involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.*  
(U//FOUO)  DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.
(U//FOUO)  We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts.  While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.  
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 6 of 8
(U//FOUO)  Appendix A: Importance of Suspicious Activity Reporting
(U//FOUO)  Given the range of targets and tactics of ISIL-associated plots since last year, we encourage reporting of suspicious activity to appropriate government authorities and encourage our security, military, and law enforcement partners to remain vigilant.  We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists.  Pre-operational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.
(U)  Indicators
(U//FOUO)  DHS encourages federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities, to include suspicious acquisition of materials and construction of explosive devices.  Some observed activities that may be suspicious include constitutionally protected activity.  These activities should not be reported absent articulable facts and circumstances that support the source agency’s suspicion that
the observed behavior is not innocent, but rather reasonably indicative of criminal activity associated with terrorism.  No single behavioral indicator should be the sole basis for law enforcement action.  The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action.
» (U//FOUO)  New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;
» (U//FOUO)  Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
» (U//FOUO)  Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
» (U//FOUO)  Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
» (U//FOUO)  Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of timea possible sign of covert stockpiling;
» (U//FOUO)  Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;
» (U//FOUO)  Internet research for target selection, acquisition of technical capabilities, planning, or logistics; » (U//FOUO)  Insisting on paying in cash or using a credit card in another person’s name; » (U//FOUO)  Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in
a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
» (U//FOUO)  Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
» (U//FOUO)  Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
» (U//FOUO)  Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 7 of 8
(U)  Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8
(U)  Source Summary Statement
(U//FOUO)  This Assessment is based on information drawn from a body of unclassified reporting, including open source media reports, public statements of senior foreign government officials, and public accounts of foreign law enforcement investigations from multiple law enforcement agencies.  We have medium confidence in the press reports used in this product, some of which have been corroborated by public statements made by senior foreign law enforcement officials.  
(U)  Report Suspicious Activity
(U)  To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement.  Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action.  For more information on the Nationwide
SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
UN C L A S S I F I E D / / F O R  O F F I C I A L  US E  O N L Y
Page 8 of 8
1 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
2 (U); OSC; EUL2015041773002595; 17 April 2015. 3 (U); OSC; EUL2015021166933318; 11 February 2015. 4 (U); OSC; EUR2015022528575929; 24 February 2015.
5 (U); OSC; EUN2015020948731295; 31 January 2015. 6 (U); OSC; EUL2015020274740312; 1 February 2015. 7 (U); OSC: EUN2015020947629159; 30 January 2015. 8 (U); OSC; EUL2015011674541100; 16 January 2015. 9 (U); OSC; EUL2015021764970267; 17 February 2015. 10 (U); DHS-OS-0316-15; 12 February 2015. 11 (U); OSC; EUL2015012065248183; 19 January 2015.
12 (U); Teen with Connection to Verviers Deceased in Syria; http://www.nieuwsblad.be/cnt/dmf20150403_01614138;
accessed 9 April 2015.
13 (U); DHS-OS-0316-15; 12 February 2015. 14 (U); OSC; EUL2015011674541100; 16 January 2015. 15 (U); Inside the ISIS Plot to Attack the Heart of Europehttp://www.cnn.com/2015/02/13/europe/europe-
belgium-isis-plot/; accessed 20 March 2015.
16 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
17 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
18 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying;
http://www.rtl.be/info/belgique/societe/verviers-voici-ce-que-les-terroristes-presume; accessed 6 April 2015.
19 (U); OSC; EUL2015021764970267; 17 February 2015. 20 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
21 (U); OSC; TRR2014092201178788; 22 September 2014. 22 (U); Belgian Operation Thwarted ‘Major Terrorist Attacks,’ Kills 2 Suspects; http://www.cnn.com/2015/01/15/
world/belgium-anti-terror-operation/; accessed 13 April 2014.
23 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/societe/
    verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
24 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/
societe/verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
25 (U); OSC; EUL2015012064970018; 20 January 2015. 26 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
27 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-
isis-plot/; accessed 20 March 2015.
28 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
    belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
29 (U); OSC; EUN201502094762159; 31 January 2015. 30 (U); Belgian Police Admit Seeking Wrong Man as Vervier Shooutout Jihadists Named; http://www.telegraph.co.uk/
news/worldnews/europe/belgium/11362093/Belgian-police-admit-seeking-wrong-man-as-Vervier-shooutout-jihadists-named.html; accessed 13 April 2015.
31 (U); OSC; EUN201502094762159; 31 January 2015. 32 (U); Terrorist Threat  Dismantled Verviers Terrorist Cell: 4 Suspects Face Council Chamber;
http://www.thebrusselstimes.com/belgium/terrorist-threat-dismantled-verviers-terrorist-cell-4-suspects-face-
council-chamber/; accessed 1 April 2015.
33 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
34 (U); OSC; EUL2015011674541100; 16 January 2015. 35 (U); OSC; EUR2015012167949567; 21 January 2015.