Europe Warned Months Ago to Plug the Border Holes

Posted on November 21, 2015November 21, 2015 by Denise Simon

The United States had better take a reality check especially when it comes to visa waiver countries, vacation visas and student visas. Those are easier to obtain that any refugee status.

EU border agency warned of migrant terror threat 18 months ago – but nothing was done

After years of inaction, sources warn it will take “months, if not years” to plug holes in Europe’s sieve-like borders.

Between France and Belgium

By Peter Foster, Europe Editor and Matthew Holehouse in Brussels

3:51PM GMT 21 Nov 2015

TheTelegraph: Frontex, the European border agency warned more than 18 months ago that radicalised European jihadis could exploit the migrant crisis in order to return to Europe and commit terrorism, but systematic checks on migrants only began last Friday, The Sunday Telegraph can reveal.

The failure of Europe’s border bureaucracy to respond to the terror threat emerged as security sources told The Sunday Telegraph that it will still be “months, even years” before Europe’s borders are fully capable of screening arrivals.

Frontex’s own risk assessment for April 2014 said that the numbers of foreign fighters travelling to Syria and Iraq for jihad had “risen threefold”, with some would-be fighters as young 15 years old.

The report noted that EU representatives were “increasingly discussing ways” to monitor and prevent young people moving to Syria, while clearly acknowledging that the fighters could return to Europe “ideologically and militarily trained, thus posing a terrorist threat to societies.”

A Frontex helicopter flies over an overcrowded raft with refugees and migrants approaching the shores of the Greek island of Lesbos Photo: REUTERS/Alkis Konstantinidis

“Overall, there is an underlying threat of terrorism-related travel movements especially due to the appeal of the Syrian conflict to both idealist and radicalised youths. It is possible that foreign fighters use irregular migration routes and/or facilitation networks (irrespective of whether this is recommended by terrorist structures or not), especially when the associated risks and costs are perceived as low in comparison to legal travel options,” the report said.

“It will take many months – and realistically years – before we screen everyone entering Europe.”

Security source to Sunday Telegraph

The cost of inaction over securing Europe’s external borders were displayed to devastating effect this week, when it emerged that Abdelhamid Abaaoud, the mastermind behind the Paris attacks, had slipped into France unchecked – via Greece – without setting off alarms.

He had previously joked in the Islamic State magazine, Dabiq, how he had once been stopped by Belgian police but not arrested.

The inability of Europe to protect its borders has been blamed on a combination of a lack of resources in poorer members like Greece, Romania and Bulgaria and privacy concerns that have stalled necessary legislation in the European Parliament.

Mohamad Nouv Khanji, a Syrian doctor waits to register with the police in refugee center in the southern Serbian town of Presevo. Khanji traveled with his passport, but the EU border security agency Frontex says most migrants enter Europe with no valid documents. Photo: AP/Darko Vojinovic

Timothy Kirkhope, a Tory MEP and former immigration minister, blamed “political correctness” and the view that “people should be allowed to go anywhere they like” for the failure to adequately stand up Frontex.

“The external border has to be protected, and if the Greeks and Italians can’t do it we have to beef up Frontex. We’ve got to put the money in,” he added. “I’ve been pressing them to get on this: to not let anyone go anywhere without being processed.”

“Frontex has no access to operational intelligence,’

Fabrice Leggeri, the executive director of Frontex

In a sign of the glacial rate of progress, the same warnings on the potential security risk posed by migrant were repeated almost word-for-word in the 2015 version of the Frontex report.

As recently as September Fabrice Leggeri, the executive director of Frontex, admitted to a House of Lords committee that Frontex had “no access to intelligence” since it was an EU agency.

Mr Leggeri said that Frontex could find “no evidence” that potential terrorists had used migrant routes to cross back into the EU, but was forced to admit that this was probably because it was not connected with anti-terror databases.

A Frontex helicopter flies over refugees and migrants seen on a beach, moments after arriving on a dinghy on the Greek island of Lesbos Photo: REUTERS/Alkis Konstantinidis

“FRONTEX, as an EU agency, has no access to this kind of operational intelligence,’ he admitted, “This may be why we cannot trace evidence of people who might be involved in terrorist activities.”

France has been demanding tough new controls ever since last January’s terror attacks on the offices of the satirical magazine, Charlie Hebdo, which were finally agreed to a meeting of EU home ministers in Brussels last week.

These include that European passenger name records (PNR) data should be collected and available for scrutiny by intelligence agencies, and that EU citizens should also be subjected to “systematic” checks when re-entering Europe.

However, senior officials have admitted to The Sunday Telegraph that it will take “months, if not years” to secure the EU borders, even as richer EU nations were offering to send small ‘hit squads’ to plug the most obvious gaps in Bulgaria, Romania and Greece.

“This kind of capacity cannot be stood up overnight,” said the source close to the discussions over securing Europe’s borders, “it will take many months – and realistically years – before we really do screen everyone entering Europe against databases of known terrorists and criminals.”

The scale of challenge was revealed in the official communique from the EU Home Ministers meeting, that admitted that many EU border posts still required “electronic connection” to relevant Interpol databases.

As a sign of the depth of concern, Dutch officials this week even floated the idea of a “mini-Schengen”, that would dramatically cut Europe’s 26-member open-frontier zone, taking it back to its original core of group of Germany, Austria, Belgium, the Netherlands and Luxembourg.

Germany and the European Commission have rejected the idea, arguing the answer must be to focus on fixing Schengen as it currently exists, perhaps even by creating an EU-wide intelligence agency, an idea that was quickly shot down by member states.

Even before the Paris attacks, Donald Tusk, the European Council president had acknowledged that the EU was in a “race against time” to stop the collapse of Schengen. “The clock is ticking, we are under pressure, we need to act fast,” he said.

In the meantime, Europe remains at risk of further terror attacks that analysts warn could shatter confidence in a Schengen free-movement system whose credibility has already been seriously damaged by two major terror attacks on Paris in the space of nine months.

Carsten Nickel, Europe analyst with Teneo Intelligence, compared the existential nature of the Schengen crisis with that of the Euro crisis earlier this year, but warned that the security issues would be even harder to fix at a European level.

“The reality is that it is going to take a while to build up the administrative and physical capabilities required to protect Europe’s external borders,” he said.

“As with the Eurozone crisis, there is a logic to creating a centralized, supra-national institutions – like, say in the case of the Eurozone, the ECB – to tackle the problem; but when it comes to security it is just not clear there is the same administrative and political capacity to deliver,” he said.

2011, POTUS Stopped Syrian Refugees, Security Concerns

Posted on November 18, 2015November 18, 2015 by Denise Simon

The real humanitarian thing to do at this point is fight this war against all enemies and fight to win it. Syrians and the rest of the refugees can go home, where most do have loyalties.

The Obama Administration Stopped Processing Iraq Refugee Requests For 6 Months In 2011

November 18, 2015 By Sean Davis

Although the Obama administration currently refuses to temporarily pause its Syrian refugee resettlement program in the United States, the State Department in 2011 stopped processing Iraq refugee requests for six months after the Federal Bureau of Investigation uncovered evidence that several dozen terrorists from Iraq had infiltrated the United States via the refugee program.

After two terrorists were discovered in Bowling Green, Kentucky, in 2009, the FBI began reviewing reams of evidence taken from improvised explosive devices (IEDs) that had been used against American troops in Iraq. Federal investigators then tried to match fingerprints from those bombs to the fingerprints of individuals who had recently entered the United States as refugees:

An intelligence tip initially led the FBI to Waad Ramadan Alwan, 32, in 2009. The Iraqi had claimed to be a refugee who faced persecution back home — a story that shattered when the FBI found his fingerprints on a cordless phone base that U.S. soldiers dug up in a gravel pile south of Bayji, Iraq on Sept. 1, 2005. The phone base had been wired to unexploded bombs buried in a nearby road.

An ABC News investigation of the flawed U.S. refugee screening system, which was overhauled two years ago, showed that Alwan was mistakenly allowed into the U.S. and resettled in the leafy southern town of Bowling Green, Kentucky, a city of 60,000 which is home to Western Kentucky University and near the Army’s Fort Knox and Fort Campbell. Alwan and another Iraqi refugee, Mohanad Shareef Hammadi, 26, were resettled in Bowling Green even though both had been detained during the war by Iraqi authorities, according to federal prosecutors.

The terrorists were not taken into custody until 2011. Shortly thereafter, the U.S. State Department stopped processing refugee requests from Iraqis for six months in order to review and revamp security screening procedures:

As a result of the Kentucky case, the State Department stopped processing Iraq refugees for six months in 2011, federal officials told ABC News – even for many who had heroically helped U.S. forces as interpreters and intelligence assets. One Iraqi who had aided American troops was assassinated before his refugee application could be processed, because of the immigration delays, two U.S. officials said. In 2011, fewer than 10,000 Iraqis were resettled as refugees in the U.S., half the number from the year before, State Department statistics show.

According to a 2013 report from ABC News, at least one of the Kentucky terrorists passed background and fingerprint checks conducted by the Department of Homeland Security prior to being allowed to enter the United States. Without the fingerprint evidence taken from roadside bombs, which one federal forensic scientist referred to as “a needle in the haystack,” it is unlikely that the two terrorists would ever have been identified and apprehended.

“How did a person who we detained in Iraq — linked to an IED attack, we had his fingerprints in our government system — how did he walk into America in 2009?” asked one former Army general who previously oversaw the U.S. military’s anti-IED efforts.

President Barack Obama has thus far refused bipartisan calls to pause his administration’s Syrian refugee program, which many believe is likely to be exploited by terrorists seeking entry into the United States. The president has not explained how his administration can guarantee that no terrorists will be able to slip into the country by pretending to be refugees, as the Iraqi terrorists captured in Kentucky did in 2009. One of those terrorists, Waad Ramadan Alwan, even came into the United States by way of Syria, where his fingerprints were taken and given to U.S. military intelligence officials.

Obama has also refused to explain how his administration’s security-related pause on processing Iraq refugee requests in 2011 did not “betray our deepest values.”

*** Were we even paying attention last February when POTUS made his declaration on accepting Syrian refugees? What changed between 2011 and earlier this year? The UN? Money? Iran?

WASHINGTON — The Obama administration’s commitment to take in potentially thousands of Syrian refugees is raising national security concerns among law enforcement officials and some congressional Republicans who fear clandestine radicals could slip into the country among the displaced.
The administration has vowed to help those who fled the civil war by providing homes, furniture, English classes and job training in the United States. It says they’ll be subject to intensive screening before entering the country, and that the overwhelming majority are vulnerable women and children.
“These are people I think that if most Americans met them, their instinct would immediately be, ‘We have to help these people,'” Anne Richard, the assistant secretary of state for population, refugees and migration, said in an interview with The Associated Press.
But without reliable intelligence within Syria, some argue that it’s impossible to ensure that someone bent on violence or supporting a militant cause doesn’t come in undetected.
The issue came to the fore at a House Homeland Security Committee hearing earlier this month, when Michael Steinbach, the FBI assistant director for counterterrorism, said the information the intelligence community would normally rely on to properly vet refugees doesn’t exist in a failed country like Syria.
“You have to have information to vet, so the concern in Syria is that we don’t have systems in places on the ground to collect the information,” Steinbach testified.
More than 3.8 million Syrians are believed to have fled their country in the four years since an uprising against President Bashar Assad led to a civil war.
Most who have resettled have traveled to neighboring countries like Lebanon, Jordan and Turkey. But those avenues are strained. Lebanon announced plans last month to impose restrictions on Syrians trying to enter the country, and an international human rights group accused Jordanian authorities in the fall of deporting vulnerable refugees, including wounded men and unaccompanied children, back to Syria.
The United States last year resettled nearly 70,000 refugees from dozens of countries and accepts the majority of all referrals from U.N. refugee programs. More than 500 Syrian refugees are in the U.S., and plans call for adding a few thousand more in the next couple of years.
But aid groups say they’d like to see the U.S. move more quickly to take in more, given the humanitarian crisis in Syria.
“They need countries like the United State that have capacity to host significant numbers to really start to share that burden,” said Anna Greene, a policy and advocacy director at International Rescue Committee, a New York-based humanitarian organization.
As the Obama administration pushes to boost the numbers, three Republican members of Congress — Reps. Peter King of New York, Michael McCaul of Texas and Candice Miller of Michigan — have asked the administration to say how many Syrian refugees it plans to resettle and to provide a timeline and steps to ensure they’re not a security risk. They warned that a weak screening process could become a “backdoor for jihadists.”
When McCaul raised the issue Wednesday with Secretary of State John Kerry, Kerry assured him that the refugees would be subject to “super-vetting” and that if the FBI expressed concerns about someone, that person would not be let in. “We have amazing ways of being able to dig down and dig deep,” Kerry said at a House Foreign Affairs Committee hearing.
The security concerns echo those voiced over the past decade, when large number of Iraqis sought U.S. refuge from that country’s war.
Two Iraqi refugees who entered the United States in 2009 were charged in Kentucky two years later with plotting to send weapons and money to al-Qaida operatives in Iraq. The case raised particular alarm within the intelligence community because one of the men was able to enter the country even though his fingerprints years several earlier had been left on an unexploded bomb in Iraq. In 2011, then-FBI Director Robert Mueller said the FBI was scrutinizing Iraqi refugees already in the U.S. for possible links to al-Qaida’s affiliate in Iraq.
U.S. officials say they’ve since tightened the controls.
The FBI’s Steinbach told Congress that unlike Iraq, where Americans personnel on the ground were able to gather intelligence, there’s no comparable “footprint on the ground in Syria.”
“All of the data sets, the police, the intel services that normally you would go and seek that information, don’t exist,” he said.
State Department officials say refugees are screened more carefully than all other visitors to the United States, checked against all databases maintained by U.S. law enforcement and intelligence agencies and undergo extensive medical checks and fingerprinting. Specially trained officers from the Homeland Security Department conduct overseas, in-person interviews with those seeking refuge. Refugees are far more likely to be victims of violence than criminals themselves.
“I think if we talk about just this faceless mob of people from conflict-ridden lands, it seems very scary,” the State Department’s Richard said. “But if you meet individuals and individual families, you start to understand the very, very human nature of what it means to be a refugee.”

Last May, DHS Warned on Belgium ISIS Cell

Posted on November 18, 2015November 18, 2015 by Denise Simon

UNC L A S S I F I E D / / F O R O F F I C I A L US E O NL Y

(U//FOUO) Future ISIL Operations in the
West Could Resemble Disrupted Belg Plot

13 May 2015

Office of Intelligence and Analysis

IA-0 -15
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

13 May 2015
(U//FOUO) Future ISIL Operations in West Could Resemble Disrupted Belgian Plot

(U//FOUO) Prepared by the Office of Intelligence and Analysis (I&A). Coordinated with NPPD, the FBI, and NCTC.

(U) Key Judgments
(U//FOUO) I&A assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West. We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little

to no warning.
(U//FOUO) I&A assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.
(U//FOUO) I&A assesses that items recovered by Belgian authorities suggest the group’s plotting may
have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting (SAR). (See Appendix A for details on the importance of SAR reporting.)

(U//FOUO)  I&A assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.
(U//FOUO)  I&A assesses that facilitation efforts by
the group were likely aided by members’ criminal
background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.
(U//FOUO)  Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.

(U//FOUO) Belgian Plot Signals ISIL’s Interest
in Complex Plots Against the West
(U//FOUO) The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated

(U) Scope
(U//FOUO) This Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL). This Assessment is intended to support the DHS activities to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.

(U) Background
(U) On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect. The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operatives—some of whom were returning foreign fighters—possibly targeting police or the public. The group may have been acting under the direction of a member(s) of ISIL. There is no publically available information as to whether a specific target was selected. Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities. The investigation into this plot remains ongoing.1,2

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 2 of 8

operations in the West. I&A judges that the threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europe—where several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacks—than in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s
geographic proximity to the conflicts in Syria and Iraq.3,4 While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland. I&A notes that small-scale attacks using comparatively less sophisticated tactics—such as the 3 May attempted attack against a
“Draw the Prophet” event in Garland, Texas by
individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social media—could proceed with little to no warning.
(U//FOUO) Dispersed Activities and Remote Leadership Possibly Intended to Conceal

Activities
(U//FOUO) The group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency sharing information about emerging and ongoing threats. Even though the group likely planned to attack targets in Belgium, the
investigation into the group’s activities spans several
European countries, including France, Greece, Spain, and the Netherlands, as well countries where there is limited- to-no counterterrorism cooperation with the United States,

such as Syria.
» (U) The purported leader of the group, Abdelhamid Abaaoud, directed the operation from a safe house in Athens, Greece using a cell phone, while other group members operated in several other European countries, according to European media reporting citing a senior Belgian counterterrorism official.5,6
» (U) In addition to the 13 arrests made throughout Belgium, two operatives were arrested in France and police apprehended a cell member in Greece after tracing links to a second safe house in Athens, according to a Belgian news conference and Greek media reporting citing senior police officers.7,8,9
» (U) Multiple members of the cell appear to have been able to communicate and travel unimpeded across borders to facilitate attack planning. In addition to directing operatives from the safe house in Athens, Abaaoud boasted he was able to return to

Syria after the Verviers raid despite having international warrants for his arrest, according to an interview featured in the February release of ISIL’s

Dabiq magazine.10
» (U) The passport of an identified Dutch national—
possibly associated with the group—who likely traveled to Syria in late 2014 was found at the Verviers safe house, according to Dutch media reporting.11 Dutch officials conducted a search of his parents’ home and confiscated laptops and other media. As of early April, he was reportedly killed while fighting in Syria, according to unconfirmed Dutch media reporting.12

(U//FOUO) Material Acquisition Suggests Attacker’s Potential Tactics and Targets
(U//FOUO) Items recovered during searches of
residences affiliated with the cell suggest the group’s
plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers. There is no publicly available information about the acquisition of these items, but the amounts and types of materials acquired by the group highlights the role of the public and private sector in alerting law enforcement through SARs of attempts to acquire or store a large cache of equipment or chemicals needed to support larger operations.
» (U) Belgian law enforcement discovered automatic firearms, precursors for the explosive triacetone triperoxide (TATP), a body camera, multiple cell phones, handheld radios, police uniforms, fraudulent identification documents, and a large quantity of cash during the raid in Verviers, according to statements made by Belgian government officials.14,15,16 At the time

UNCLASSIFIED

(U) A picture, from ISIL’s Dabiq magazine, of Abdelhmaid Abaaoud (far right) with the two alleged cell members killed during the January 2015 raid in

Verviers, Belgium.13

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 3 of 8

of the raid, the members of this cell were also searching for an ice machine to cool and transport the TATP, according to European press reporting.17
» (U) Belgian officials were reportedly concerned that the acquisition of police uniforms and discussion by group members of a Molenbeek police station—where members of the group had reportedly spent time—
suggests that they may have intended to target a police station or to impersonate officers to potentially gain access to a sensitive site. 18,19,20 While there is no confirmation the group was actually going to target police, such an attack would have been consistent with media reports about recent ISIL-linked plots in the West directed at law enforcement and ongoing messaging by ISIL since September 2014.21

(U//FOUO) Alleged Operational Security Measures Suggest Knowledge of Law Enforcement Methods
(U//FOUO) The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications. The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to

deflect scrutiny.
(U//FOUO) Communications Security. The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
» (U) A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for

microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police

officials.23
» (U) According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.24
» (U) Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious
communications, according to Belgian media reporting.25
(U//FOUO) Physical Security.  The group attempted to obscure their operational travel and material acquisition from Belgian officials.
» (U//FOUO) According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria. However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.26
» (U//FOUO) Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports. 27,28,29 Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning. 30
» (U//FOUO) The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s
procurement activities and to conceal purchasing patterns.31  Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.

UNCLASSIFIED

(U) Belgium investigators at scene following the raid in Verviers, Belgium on 15 January 2015.22

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 4 of 8

UNCLASSIFIED

(U) Figure 1. Map of Group Activities

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 5 of 8

(U//FOUO) Member’s Criminal Background Likely Aided Planning and Facilitation
(U//FOUO) Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts. The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious

intentions.
» (U) At least one alleged cell member, Souhaib el Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.32 The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.33
» (U) The Belgian police uniforms, large cache of illegal weapons—including Kalashnikov rifles, handguns, ammunition, and materials to make explosives—that were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference.34 Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.35

(U) Implications
(U//FOUO) I&A assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small
groups of individuals, raising I&A’s concern that the
involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.*
* (U//FOUO) DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.

(U//FOUO) We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts. While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 6 of 8

(U//FOUO) Appendix A: Importance of Suspicious Activity Reporting
(U//FOUO) Given the range of targets and tactics of ISIL-associated plots since last year, we encourage reporting of suspicious activity to appropriate government authorities and encourage our security, military, and law enforcement partners to remain vigilant. We face an increased challenge in detecting terrorist plots underway by individuals or small groups acting quickly and independently or with only tenuous ties to foreign-based terrorists. Pre-operational indicators are likely to be difficult to detect; as such, state, local, tribal, territorial, and private sector partners play a critical role in identifying and reporting suspicious activities and raising the awareness of federal counterterrorism officials.

(U) Indicators
(U//FOUO) DHS encourages federal, state, local, tribal, and territorial counterterrorism officials, as well as first responders and private sector security partners, to remain alert and immediately report suspicious activity and potential behavioral indicators of pre-operational terrorism planning activities, to include suspicious acquisition of materials and construction of explosive devices. Some observed activities that may be suspicious include constitutionally protected activity. These activities should not be reported absent articulable facts and circumstances that support the source agency’s suspicion that
the observed behavior is not innocent, but rather reasonably indicative of criminal activity associated with terrorism. No single behavioral indicator should be the sole basis for law enforcement action. The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action.
» (U//FOUO) New or increased advocacy of violence, including providing material support or recruiting others to commit criminal acts;
» (U//FOUO) Reports to law enforcement that a community member has adopted a new name, style of dress or speech, and/or other significant changes in presentation to others in association with advocacy of violence;
» (U//FOUO) Communicating with known or suspected homegrown or foreign-based violent extremists using e-mail or social media platforms;
» (U//FOUO) Photography or videography focused on security features, including cameras, security personnel, gates, or barriers;
» (U//FOUO) Attempts to purchase all available stock of explosives precursors or to acquire materials in bulk without explanation or justification or making numerous smaller purchases of the same products at different locations within a short period of time—a possible sign of covert stockpiling;
» (U//FOUO) Theft of chemicals, hazardous substances, weapons, pre-cursor materials, or items that could compromise facility security, such as uniforms, identification, blueprints, vehicles (or components), technology, or access keys or cards;
» (U//FOUO) Internet research for target selection, acquisition of technical capabilities, planning, or logistics; » (U//FOUO) Insisting on paying in cash or using a credit card in another person’s name; » (U//FOUO) Participation in weapons training, paramilitary exercises, and reconnaissance and surveillance activities in
a manner that is reasonably indicative of pre-operational planning related to terrorism, particularly in conjunction with advocacy of violence;
» (U//FOUO) Use of cover terms to mask the true meaning of events or nefarious activities combined with active advocacy of violence;
» (U//FOUO) Acquisition of suspicious quantities of weapons and ammunition, or materials that could be used to produce explosives, such as hydrogen peroxide, acetone, gasoline, propane, or fertilizer; and
» (U//FOUO) Activities that a reasonable person would deem as suspicious, indicating a storage facility or other areas are being used to construct an explosive device.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 7 of 8

(U) Tracked by: HSEC-8.1, HSEC-8.2, HSEC-8.3, HSEC-8.5, HSEC-8.8

(U) Source Summary Statement
(U//FOUO) This Assessment is based on information drawn from a body of unclassified reporting, including open source media reports, public statements of senior foreign government officials, and public accounts of foreign law enforcement investigations from multiple law enforcement agencies. We have medium confidence in the press reports used in this product, some of which have been corroborated by public statements made by senior foreign law enforcement officials.

(U) Report Suspicious Activity
(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. For more information on the Nationwide

SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx.

UN C L A S S I F I E D / / F O R O F F I C I A L US E O N L Y

Page 8 of 8

1 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
2 (U); OSC; EUL2015041773002595; 17 April 2015. 3 (U); OSC; EUL2015021166933318; 11 February 2015. 4 (U); OSC; EUR2015022528575929; 24 February 2015.
5 (U); OSC; EUN2015020948731295; 31 January 2015. 6 (U); OSC; EUL2015020274740312; 1 February 2015. 7 (U); OSC: EUN2015020947629159; 30 January 2015. 8 (U); OSC; EUL2015011674541100; 16 January 2015. 9 (U); OSC; EUL2015021764970267; 17 February 2015. 10 (U); DHS-OS-0316-15; 12 February 2015. 11 (U); OSC; EUL2015012065248183; 19 January 2015.

12 (U); Teen with Connection to Verviers Deceased in Syria; http://www.nieuwsblad.be/cnt/dmf20150403_01614138;

accessed 9 April 2015.
13 (U); DHS-OS-0316-15; 12 February 2015. 14 (U); OSC; EUL2015011674541100; 16 January 2015. 15 (U); “Inside the ISIS Plot to Attack the Heart of Europe”; http://www.cnn.com/2015/02/13/europe/europe-

belgium-isis-plot/; accessed 20 March 2015.
16 (U); “Belgium Terror Group Planned to Kill Police Officers”; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
17 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.
18 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying;
http://www.rtl.be/info/belgique/societe/verviers-voici-ce-que-les-terroristes-presume; accessed 6 April 2015.

19 (U); OSC; EUL2015021764970267; 17 February 2015. 20 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
21 (U); OSC; TRR2014092201178788; 22 September 2014. 22 (U); Belgian Operation Thwarted ‘Major Terrorist Attacks,’ Kills 2 Suspects; http://www.cnn.com/2015/01/15/
world/belgium-anti-terror-operation/; accessed 13 April 2014.
23 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/societe/
verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.
24 (U); Verviers: What the Terrorist Suspects under Surveillance Were Saying; http://www.rtl.be/info/belgique/
societe/verviers-voici-ce-que-les-terroristes-presumes-sous-ecoute-se-disaient-693909.aspx; accessed 18 March 2015.

25 (U); OSC; EUL2015012064970018; 20 January 2015. 26 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.
27 (U); Inside the ISIS Plot to Attack the Heart of Europe; http://www.cnn.com/2015/02/13/europe/europe-belgium-

isis-plot/; accessed 20 March 2015.
28 (U); Belgium Terror Group Planned to Kill Police Officers; http://www.telegraph.co.uk/news/worldnews/europe/
belgium/11349805/Belgium-terror-suspects-planned-to-seize-passenger-bus.html; accessed 3 April 2015.

29 (U); OSC; EUN201502094762159; 31 January 2015. 30 (U); Belgian Police Admit Seeking Wrong Man as Vervier Shooutout Jihadists Named; http://www.telegraph.co.uk/
news/worldnews/europe/belgium/11362093/Belgian-police-admit-seeking-wrong-man-as-Vervier-shooutout-jihadists-named.html; accessed 13 April 2015.

31 (U); OSC; EUN201502094762159; 31 January 2015. 32 (U); Terrorist Threat – Dismantled Verviers Terrorist Cell: 4 Suspects Face Council Chamber;
http://www.thebrusselstimes.com/belgium/terrorist-threat-dismantled-verviers-terrorist-cell-4-suspects-face-
council-chamber/; accessed 1 April 2015.
33 (U); Belgium Confronts the Jihadist Danger Within; http://www.nytimes.com/2015/01/25/world/europe/belgium-
confronts-the-jihadist-danger-within.html; accessed 3 April 2015.

34 (U); OSC; EUL2015011674541100; 16 January 2015. 35 (U); OSC; EUR2015012167949567; 21 January 2015.

Lisbon Treaty and Confirmed Bomb on Russian Plane

Posted on November 17, 2015November 17, 2015 by Denise Simon

BBC: France has mobilised 115,000 security personnel in the wake of Friday’s Paris attacks by Islamist militants, Interior Minister Bernard Cazeneuve has said.

Mr Cazeneuve said 128 more raids on suspected militants were carried out. French air strikes also hit Islamic State in Syria overnight.

IS has said it carried out the attacks on bars, restaurants, a concert hall and a stadium in which 129 people died.

A huge manhunt is under way for one of the suspects, Salah Abdeslam.

He is believed to have fled across the border to his native Belgium. Belgian police have released more pictures of the wanted man. More here including recent facts, timeline and target locations.

***

John Kerry is in Europe working as a mediator and is guiding discussions on Europe’s offensive measures. Belgium is on high alert as is the UK but Germany appears to be passive. France has deployed a carrier group and has launched a second night of sorties, striking 19 targets and provided by U.S. intel sources. Meanwhile, officials have confirmed there was a bomb on board the Russian commercial aircraft that was brought down over the Sinai by the Islamic State faction in that province. The bomb was 1.5 kilos of TNT, which is more than what brought down PanAm flight 103 over Lockerbie. Russia has offered a $50 million dollar reward and the Egyptian security services have detained 2 airport suspects.

Meanwhile, what is on tap with Europe is a new security discussion not under NATO but rather the European Union Lisbon Treaty which John Kerry is participating.

BRUSSELS—Defense ministers gathered in Brussels Tuesday to discuss a French decision to invoke the mutual defense clause of the European Union’s Lisbon treaty.

The clause of the Lisbon Treaty has never been invoked, pushing the European Union into new territory.

French Defense Minister Jean-Yves Le Drian declined to speak as he entered the European Union Council building Tuesday.

Two French officials said that the EU treaty provision, 42-7, was being invoked to try to prod the union to move forward on border control issues and increased intelligence sharing.

French officials said there needs to be agreement on stronger background and passenger name record checks on the European Union’s external borders — something that EU member states have been pressing for well over a year. The French also want more cooperation on illegal arms sales within Europe.

“Cooperation has not moved forward for years,” said a French official. “We are asking the EU to move forward on a number of issues that have been stuck for years,” said a French official..

Another French official said the use of the EU treaty could also help prompt better, and faster, intelligence sharing within the union.

French officials don’t want to invoke the NATO treaty, arguing the current coalition is a more nimble organization with which to strike at Islamic State targets.

While French requests carry great weight within the European Union, it isn’t clear whether the move will be able to resolve the disagreements over border control or other issues.

Measures to increase passenger name record screening have so far been blocked because of resistance to the measures in the European Parliament, forcing rounds of negotiations between capitals, lawmakers and the EU’s executive, the European Commission.

There have also been frequent calls since the migrant crisis began to tighten external border controls but apart from Hungary’s move to build fences on its border and a greater effort to register people entering the bloc in Italy and Greece there has been limited progress.

In a news conference late afternoon Monday, EU foreign policy chief Federica Mogherini said it was too early to react to the French request, which she said she would discuss Tuesday morning with Mr. Le Drian.

“Obviously we will take a careful look at that politically with the French authorities first of all, with the rest of the European institutions including the legal services and obviously we’ll come up with a follow up to that,” Ms. Mogherini said. “Obviously we have started to work on this.”

On Tuesday, most defense ministers declined to comment on the proposal in advance of the French presentation, but expressed support for France in the wake of the terrorist attacks.

“We will defend our security, our freedom, our way of living and we will not be intimidated,” said Jeanine Hennis- Plasschaert, the minister of defense for the Netherlands.

Dabiq, Paris and Attackers Identified

Posted on November 16, 2015November 16, 2015 by Denise Simon

Dabiq #7 PJMedia: On February 12, 2015, the Islamic State (ISIS) released the seventh issue of its English-language magazine Dabiq. The 83-page issue celebrates the recent attacks in Paris, justifies the burning of the Jordanian pilot, and calls for Muslims in the West to join ISIS, among other topics discussed. It also includes interviews with Hayat Boumeddiene, the wife of Paris kosher supermarket attacker Amedy Coulibaly, and with Belgian ISIS fighter Abdelhamid Abaaoud, the leader of the Verviers cell that planned major attacks in Belgium. Much more here.

Images of the moment suspect in Paris attacks was captured.

MiddleEastEye: French prosecutors said seven people carried out the attacks in Paris on Friday, all of whom were either killed by police or killed themselves with suicide vests. Meanwhile, French police are hunting with Belgian police for a suspected “sleeper cell” linked to the attacks.

Authorities have released the identities – or assumed identifies – of five thought to be directly involved in the Paris attacks, and two others believed to have either planned or aided them. Here are the details and backgrounds of those known so far:

Alleged mastermind – Abdelhamid Abaaoud

A French official told the AP news agency on Monday that Abaaoud is a Belgian and the suspected mastermind of the Paris attacks. They released few details, but also linked him to an an attempted gun attack on a Amsterdam-Brussels-Paris train on 21 August, which was thwarted by passengers. RTL radio in France reported that the 27-year-old is of Moroccan origin and “one of the most active Isis executioners” in Syria. He was interviewed in the Islamic State (IS) English-language propaganda magazine Dabiq under the nom de guerre, Abu Umar al-Baljiki.

Bataclan attacker – Samy Amimour

Described by prosecutors as a 28-year-old Frenchman. Amimour was one of three people who attacked the Bataclan concert venue, with 89 people confirmed dead. Prosecutors said Amimour had been charged in a terrorism investigation in 2012, was placed under judicial supervision and was the subject of an international arrest warrant.

Amimour was reported as having lived in the north-eastern suburb of Drancy.

Prosecutors said Amimour was “known to anti-terrorist investigators for being charged on October 19, 2012 for conspiracy to commit terrorism” over a foiled attack in Yemen. He violated his judicial supervision in 2013, prompting judges to issue an international arrest warrant. His family told AFP, in an interview before Friday’s attacks in Paris took place, that he had gone to Syria in 2013.

Bataclan attacker – Ismael Omar Mostefai

The 29-year-old French national was identified by French officials by DNA from a severed fingertip. Mostefi had a record of petty crime in France and had been identified by police as “radicalised”. Turkey on Monday said that they had warned France on two occasions about Mostefi’s activities.

He was reported to have been raised in Courcouronnes in Essonne, 25km south of Paris. His parents, or at least his father, is believed to have been of Algerian descent and his family now lives in the small town of Romilly-sur-Seine, a small town 130km east of Paris.

Mostefi’s 34-year-old brother contacted police on his own initiative before being taken into custody, along with his father. The father’s home in Romilly was searched, along with his brother’s home in nearby Bondoufle.

Stade de France bomber – Ahmad al-Mohammad

A suicide bomber, who blew himself up outside the Stade de France stadium, was found with a Syrian passport with the name Ahmad al-Mohammad, a 25-year-old born in Idlib. The prosecutor’s office says fingerprints from the attacker match the passport, which passed through Greece in October. Greece says he was one of two attackers who passed through their territory in the months before the attack. Serbia yesterday said the passport was also registered at the Presevo border crossing on 7 October, where he formally sought asylum.

Whether Mohammad is the real name of the attacker remains in doubt, however. The passport had been reported fake in the days after the attacks in Paris, and there is a thriving trade in the Middle East for such items. Prosecutors in France on Monday said the name “remained to be verified”.

Stade de France bomber – Bilal Hadfi

Identified by investigation insiders as a 20-year-old French national who had been living in Belgium. He is reported to have fought for the Islamic State (IS) in Syria.

Restaurant attacker – Brahim Abdeslam

Officials identified Abdelslam as an attacker who blew himself up near a cafe on the Boulevard Voltaire. He was described as a French national and the brother of Salah Abdelslam, who is the subject of an arrest warrant over the Paris attacks.

Alleged fixer – Salah Abdelslam

Abdelslam, a 26-year-old born in Brussels, was arrested late Monday morning. Authorities said Abdeslam rented a Volkswagen Polo that carried attackers to the Bataclan concert venue. French officials told the AP news agency on Saturday that police had questioned and released him early in the day after stopping a car carrying three men near the Belgian border. An arrest warrant, describing Abdelslam as armed and dangerous, had been issued hours before.