A car theft in the Netherlands, a seemingly insignificant note that was found in Molenbeek, and a shop for swimming pool equipment in the North of France. These are the three ingredients of the best clue there ever has been to thwart the Paris and Brussels attacks — a new investigation by the Belgian newspaper Het Laatste Nieuws reveals.
A lot has been written already about the clues that security services missed in the run-up to the Paris and Brussels attacks — clues that could have prevented the bloodshed by Islamic State. Could have. In hindsight, it is easy to list the mistakes. Yes, it was known to the police that Salah Abdeslam had started to radicalize. But at that time, it was the case with tens, if not hundreds of Belgian Muslims like him. And yes, only 22 days before the Paris attacks, a search took place in the house of Khalid El Bakraoui because he tried to obtain kalashnikov chargers. But he was known as a gangster and in the end no weapons were found.
Bayroshock without chlorine
About one clue, however, nothing has been published yet — and that clue is likely the very best chance authorities missed to detect the terrorist cell. It started with the theft of a car in a small village between the Dutch rivers Maas and Waal. It was a silver colored Audi S4 built in 2003 that disappeared in the night from August 10 to 11, 2015 at a parking lot in Rijswijk — part of the municipality of Woudrichem and not to be confused with the much bigger town of Rijswijk near The Hague. “Klerelijers”, a friend of the owner reacted at a notice on Facebook, using an equivalent for “assholes” that is endemic for the Netherlands — while another one hurled: “Your country will be proud of you”, easily assuming that the thief was of foreign origin.
The rightful owner got his car back after it was found in the Brussels municipality of Molenbeek, and during a subsequent house search a handwritten note was found. It seemed of little importance: “Bayroshock without chlorine”, it mentioned, followed by the addresses of two shops for swimming pool equipment in the North of France. Bayroshock is a product against algae that consists of hydrogen peroxide at a concentration of 34%. Apart from being recommended for the treatment of pools, that same substance is also a main ingredient of TATP. Triacetone triperoxide is the explosive often called ‘the Mother of Satan’ and known as a terrorist’s favorite since the failed attempt by ‘shoe bomber‘ Richard Reid to blow up a plane between Paris and Miami in December 2001.
The man in whose house the note was found, is Ahmed Dahmani — a naturalized Belgian citizen of Moroccan descent. He was born in 1989 in Al Hoceima, a town between the Rif mountains and the Mediterranean Sea. In 2015, he was living in a fourteen-storied building in the Molenbeek ‘Zone du Canal’ — not the kind of address where a swimming pool owner can be expected. He was mainly known to the judiciary as a multi-recidivist criminal, who was caught for theft already at the age of twelve. The latest of the 51 cases in which his name appeared, was about a massive traffic in hard drugs between Belgium, France and Luxembourg. But there were signs of radicalization too, much stronger signs in fact than those present at that time with his childhood friend Salah Abdeslam.
Blessing the expansion of Shariah4Belgium
With Abdeslam, he underwent an identity check on board of a ferry between Patras in Greece and Bari in Italy only a week before the car theft in the Netherlands. Now, we know that they conducted one of many travels along the refugee route that was used by the Islamic State to smuggle terrorists to the West, but then it understandingly did not raise a particular suspicion yet. Ten days after the search that uncovered the note, however, Dahmani was named in a report about radicalism. Written by a motorized patrol of the Brussels police that had apprehended a suspected candidate for the Syrian jihad. Friends of the suspect had tried rather brutally to prevent that arrest, and Dahmani was one of them.
At Facebook, Dahmani did not hide his beliefs. There, he complained in 2014 already that the word extremism was “invented by enemies of the Islam”, while posting a quote that the Islamic State often uses to recruit criminals like him for the jihad — the one in which the second caliph Omar ibn al-Khattab declared: “Sometimes the people with the worst past create the best future”. Dahmani also posted Islamic State videos, and three days before a terrorist attack was foiled in Verviers — in January 2015 — he threatened: “One day everything will be paid.” He did all of that under the cover of a pseudonym, but his contacts with a suspect in the Verviers case could have lead to his identification back then already.
In Dahmani’s family tree, radicalism became obvious almost a decade ago. His older brother Mohamed — who basically raised him instead of their always absent father and their chronically ill mother — was named in a terrorist case as early as 2009. He was investigated for his contacts with the suspects of a bomb attack in Cairo that killed a French teenager — the same suspects behind the earliest plot against the Bataclan in Paris. Mohamed Dahmani was never charged, but by the time his brother Ahmed entered the scene, at least three of Mohamed’s friends had left for Syria. One of them departed from Brussels in the company of the later terrorist commander Abdelhamid Abaaoud. And in 2012 already, Mohamed himself was known as a patron of Shariah4Belgium, asked explicitly for his blessings when leader Fouad Belkacem wanted to expand his recruitment from Antwerp to Brussels.
“Talking like youngsters, but not impolite”
Altogether, there were plenty reasons to raise the alarm when Ahmed Dahmani showed his interest in an ingredient for bombs. But that did not happen, and at the 8th of October 2015 — a month after the note of Dahmani was found — a BMW left Molenbeek towards the North of France. At 4h04 that afternoon, the car was caught by a speed camera at the A2 highway in Neuville-sur-Escaut. The license plate would later learn that the vehice was rented by Salah Abdeslam, and the GPS revealed two stops: at 5h02 in the rue Maurice Thorez in Saint-Sauveur, and at 5h44 in the rue Ferdinand de Lesseps in Beauvais — the two shops mentioned on Dahmani’s note.
Both are branches of Irri Jardin, a chain “for your swimming pool, irrigation and spa”. The shop in Saint-Sauveur had ran out of Bayroshock, it seems. But the Beauvais manager recounted to the police how he sold his entire stock that day. “I had three jerrycans of five liters each, and they asked for more. When I told that half a jerrycan is sufficient for one pool, they claimed that they did the maintenance of several pools in the Paris area. Then they asked for a similar product, which I couldn’t offer. ‘Let’s buy these three then, we have to leave’, one of them said. They paid with cash and didn’t look tense, only a bit in a hurry.”
The manager described the two men as North-Africans between 25 and 30 years old. Both were of average build, had short hair and a short shaved beard. One of them was wearing a jacket over his sweater, the other one a bodywarmer. They spoke French — also when they talked to each other — without a particular accent. “They expressed themselves like youngsters do, but they weren’t impolite”, the manager said. Confronted with the pictures of known suspects, he thought to recognize Salah Abdeslam. But he wasn’t sure. Altogether, the two men spent no more than seven minutes in his shop, after which they made a fuel stop at the Total station of Hardivillers and returned to Molenbeek.
Forbidden in Belgium now, but not in France
French investigators are fairly confident that their purchase has served to fabricate the bombs that were used for the attacks in Paris on the night of 13 November 2015. There were eight explosive belts, of which two have failed to detonate. Each of them contained between one and two kilograms of TATP, and according to explosives experts of the French police, the terrorists could make ten kilograms with fifteen liters Bayroshock. In Belgium, the EU directive banning the sale of hydrogen peroxide in concentrations above 12% to private customers was passed into law in July 2016. But in France, a softened version entered into force last year, just requiring registration for private purchases.
Ahmed Dahmani is in Turkish custody now. He took a flight in Amsterdam on the morning after the Paris attacks, with a ticket that was bought a few hours prior to the bloodbath — indicating that he knew what was going to happen. When he was arrested near Antalya on the 16th of November 2015, he was still in the possession of his Belgian documents, including membership cards of the Christian trade union CSC and the Grand Casino in Brussels. In the meantime, however, he had also bought a false Syrian passport with the name Mazen Mohamad Ali, and the WhatsApp conversations on his phone revealed that he had planned to reach the territory of Islamic State. In December 2016, a Turkish court convicted him to ten years and nine months in jail for membership of a terrorist organization. After he has served that sentence, Belgian and French extradition requests are awaiting him.
For months already, Oussama Atar (33) is named as mastermind behind the Brussels and Paris attacks. The Belgian jihadist of Moroccan descent is said to be identified as the mysterious ‘Abu Ahmad’, who organized the bloodshed from Syria. But in today’s edition of Het Laatste Nieuws, Belgium’s largest daily newspaper, we reveal how questionable that identification is. Documents that we’ve obtained, clearly show that the investigators desperately want to frame Atar as Abu Ahmad, but lack any evidence.
The Abu Ahmad alias entered the investigation in two different ways. One of them was the laptop found shortly after the Brussels attacks on the 22nd of March 2016 in a trash can near the terrorist’s safe house at rue Max Roos in Schaerbeek. That computer contained some audio messages of the perpetrators to their chief in Syria. A man they called Abu Ahmad — as we could verify in transcripts — and to whom they explicitly told: “ You’re the one who decides. You’re the amir.”
The second mention of Abu Ahmad came up during the interrogations of Adel Haddadi and Muhammad Usman. They are two Islamic State terrorists who were caught in Austria after being sent from Syria to commit attacks in the West. They both have stated that it was Abu Ahmad who gave them the orders. That has happened in person, so Haddadi and Usman are the only ones in custody certainly able to tell more about him.
It is the interrogation of Adel Haddadi that has supplied the most important evidence against Oussama Atar. Haddadi is said to have recognized him as Abu Ahmad. The transcript of that interrogation however, which we could read, tells a somewhat different story. On the 20th of October 2016, a French judge investigating the Paris attacks confronted Haddadi with pictures of ten different men, asking explicitly whether one of them was Abu Ahmad.
Haddadi pointed to the picture of Atar indeed — but he was not sure and also raised a second possibility. “Number one resembles Abu Ahmad”, he said. “But there are some differences. Abu Ahmad has a leaner face, he is older, his head seems smaller and his beard is not that thick. But the picture looks like him. There is also similarity between picture number ten and Abu Ahmad, but it is the man in picture number one that most closely resembles him.”
The differences that he raised, may be explained by the picture being somewhat outdated. Similarly, that he described Abu Ahmad as a man who has surpassed the age of forthy already and speaking Arabic with a Syrian or Iraqi accent, may be a consequence of Oussama Atar’s past. He spent seven years in an Iraqi jail, which may have had an impact on his accent, while the harsh imprisonment can have made him looking older than he really is.
That said, it would be rather biased to declare that Haddadi offered a solid identification — but it was exactly that what investigators did. The next day already, when the same French judge showed the same ten pictures to Muhammad Usman. He declared that he did not recognize any of them. “I am sure”, he said. The French judge insisted, saying that Haddadi had been “almost sure” of picture number one. “That’s not Abu Ahmad”, Usman replied. “I am sure of myself.”
Normally, the sum of a doubtful “yes” and a “no” is not considered as a confirmation. But when a international arrest warrant for Atar was issued on the 17th of November 2016 by a Belgian judge, it stated explicitly that Haddadi had recognized him “with near certainty” as Abu Ahmad. Usman’s contradicting view wasn’t mentioned at all.
It is very well possible that Oussama Atar indeed is Abu Ahmad. He has lots of indications pleading against him. It seems rather sure by now that his brother Yassine Atar had a role in the terrorist plot, and according to the documents that we could see, at least one witness says that it has been under the influence of Oussama Atar that Khalid and Ibrahim El Bakraoui were radicalized.
The Bakraoui brothers were protagonists of the Paris and Brussels attacks. First they arranged at lot of the logistics, and ultimately they blew up themselves. They are nephews of Atar, and it must have sounded like music to the investigator’s ears when Osama Krayem — the terrorist who had refrained from an attack at Maelbeek metro station in Brussels — declared that Abu Ahmed must have been related to them. “Otherwise, he never would have trusted them that much.”
Krayem didn’t say so because he knew, it can be learned from interrogation transcripts that we have seen. “I don’t know Abu Ahmad”, he assured. “But police has showed me a picture already recognized by others as Abu Ahmad. And I learned from media reports that it was Oussama Atar.” While Krayem thus explicitly stated that he had only second hand information about Abu Ahmad — and also that he knew perfectly well what the interrogators liked to hear — a great deal of weight was given to his assumption.
At least three times he was pushed again to confirm that Abu Ahmad was a relative of the Bakraoui brothers. And the more he was asked, the more affirmative he became. So at the end, his assumption about Abu Ahmed being a family member of the Bakraoui brothers appeared as a fact in the arrest warrant for Atar.
Many myths are told already about Oussama Atar. That he has been imprisoned with Islamic State’s caliph Abu Bakr al-Baghdadi for instance — while the latter was already free again when Atar was arrested near Ramadi on the 24th of February 2005. Recently, it was reported that Atar has visited his family in Brussels last summer, at a time he was sought world wide already. But that rumour was never confirmed.
On the other hand, we are able to refute that the young Atar went to Iraq for humanitarian reasons, as often is told. In an e-mail we received from the press desk of the Multi-National Forces in Iraq when inquiring about Atar in 2007 already, sergeant Matthew Roe wrote: “The defendant admitted that he had entered Iraq illegally to wage war against Americans and had attended anti-Multi-National Forces sermons. The defendant repeated these statements to Multi-National Forces while in MNF custody.”
The terrorist cell behind the Paris and Brussels attacks apparently has kept its weapons and explosives for a while in a Belgian school. That can be concluded from a map on a laptop used by Salah Abdeslam — as we reported today in the Belgian newspaper ‘Het Laatste Nieuws’.
It was after the shooting during which Salah Abdeslam was able to escape on the 15th of March 2016, that a laptop was found in his safe house at rue Dries in the Brussels municipality of Forest. That HP EliteBook 8440p contained videos of extremist preachers, pictures of possible targets, information about weapons and military gear, but also a map that was titled ‘Salah’ — indicating that it was used by Abdeslam. Many files were erased, but computer specialists of the Belgian federal police were able to retrieve them, and by doing so they also discovered a rather remarkable map.
The hand-drawn map mentioned two street names: Saviostraat en Elzenstraat. A combination that only exists in Meulenberg, a neighborhood of Houthalen-Helchteren in the east of Flanders, infamous for its security issues and cases of radicalism. The buildings on the map turned out to be the local kindergarten and elementary school. Curious about what Islamic State terrorists were looking for at such a location, about twenty police officers went to Meulenberg on Saturday the 11th of June 2016.
They were armed with search warrants and in the company of Gorro, an explosives dog. The instructions written in French on the map led them along a first building, the regional center for student coaching, to the kindergarten’s playground. There, they found a hole cut in the fence, exactly at the place where was mentioned at the map: “Here you have to jump over”. The hole provided access to an overgrown piece of garden in which they found a ramshackle shed and a garage.
One of the doors in the garage showed traces of a burglary. But besides old school furniture, there was nothing found inside. The investigators left without any answers, but they did inform the State Security — Belgium’s intelligence service. That resulted in a confidential note on the 28th of July 2016 — a document that we have obtained. State Security found out that a former concierge of the sports hall next to the school was killed in Syria fighting for Islamic State. Younes Laabadi, 43 years old at that time, was linked by marriage to the family of Mohamed Abrini — the ‘man with the hat’ who had escaped alive during the Brussels attacks on the 22nd of March 2016.
Putting all the pieces together, the investigators concluded that the school domain has likely served as a weapon storage place. It is known that the terrorist cell possessed an arsenal of which at least four kalashnikov-type rifles, a riot gun, two pistols, two hand grenades and an amount of explosives were left after the massacre in Paris on the 13th of November 2015. Those weapons weren’t used for the Brussels attacks, and a intercepted conversation made clear that they had planned to hide the stash for later attacks.
That was reason enough for the investigators to conduct a second search on Wednesday the 10th of July 2016. Done by ten officers, with the explosives dog Jessy, and also in the sports hall this time. But again it was in vain. The assumption that the weapons have been hidden at the school remains however. “Considering the burglary traces, the possibilit exists that the weapons were retrieved and stored elsewhere just before the Brussels attacks”, the State Security document reads.
In the meantime, there are even strong suspicions of who has carried the weapons away to hide at another place — a location, by the way, that still isn’t found. According to the intercepted conversation, that assignment was given to a certain ‘Abu Imran’, described as “a brother who has been in Syria already”. That fits perfectly well with the profile of Bilal El Makhoukhi (28), a terrorist from Brussels already known as Abu Imran, who lost a leg while fighting for Islamic State. He already admitted having been in touch with the Brussels terrorist cell in the week before the attacks, while arrested terrorist Osama Krayem declared during one of his interrogations that he met El Makhoukhi in a safe house in Laeken.
It isn’t known how long the weapons possibly were hidden at the school domain. But it is a certainty that they posed a terrible risk. The suspicious garage is situated only twenty meters from the kindergarten, and even closer to the student coaching center. It is thought that the stash contained explosives of the types C4 and TATP. The first is both extremely powerful and hard to detonate, but the latter so unstable that it can explode by heat, friction or shock. That could easily have led to a devastating chain reaction causing lots of casualties.
The two men who are in a Belgian jail because they brought Paris suspect Salah Abdeslam back to Brussels, made suspicious journeys before. Hamza Attou went to the UK with a man of Iraqi descent only three days before the attacks, while Mohamed Amri visited Turkey at least seven times during the past two years.
Mohamed Amri (26) and Hamza Attou (21) belonged to the very first suspects who were caught after the Paris attacks. They quickly confessed that they had brought the only surviving perpetrator back to Brussels that night. On the phone, Salah Abdeslam reportedly said that he had suffered a car accident. It was only when they met him in Paris, that he told them about his role in the bloodbath. According to their declarations, he threatened to blow up Amri’s Volkswagen Golf if they refused to give him a lift.
Amri and Attou are still behind bars, but no details have surfaced yet about a further implication in the terrorist plot. When Molenbeek mayor Françoise Schepmans named the Paris suspects who were on a list of radicalized inhabitants prior to the attacks, she did not mention these two. In the 55 pages long report that the Paris police has written about the attacks for the French Interior Minister Bernard Cazeneuve however, it is stated that the Belgian authorities knew Amri already as “being close to the movement of the extremist Islam”.
That same report also reveals how both Amri and Attou undertook suspicious journeys in the days and years before the Paris attacks. Airline registers learned that Amri went to Istanbul at least seven times between May 2013 and May 2014. When returning, he often flew to other destinations than his home town Brussels — such as Paris, Marseille, and Copenhagen. The report contains no proof that his travel was related to terrorist activities, but they happened at a time when Turkey served as the main gate to Syria for tens of members of the network behind the Paris and Brussels attacks.
Hamza Attou left Belgium on the 10th of November 2015 for a journey to the UK. He did so in the company of a man from Brussels with roots in Iraq, and a Dutchman of Somali descent. It was the latter who drove the Ford Focus with Dutch license plate when they boarded the ferry from Dunkerque to Dover. Their tickets were booked by an autochtonous Dutchman we could reach and who provided some background about the trip.
He told us that the Dutchman of Somali descent is a youth friend who wanted to visit relatives in the UK. “On the internet, he searched for people who would join him in order to share some of the costs. That’s how he came into contact with the men from Brussels. He did not know them at all prior to that England trip.” Reportedly, the trio was stopped in the UK because something was wrong with the identity papers of one of the Brussels men. But what exactly was the problem, is not known — and neither is how long they were held.
The men from Brussels did not travel back together with the Dutchman, but if they did so with their initial reservation, they came back the very same day as the Paris attacks. Again, the French police report does not allege that their stay in the UK was somehow linked to terrorism. The Brussels man of Iraqi descent, 43 year old A.J.I.H. seems to have relatives living in London, which can mean there is a completely innocent reason for visiting the UK. We do not know whether he was interrogated about the trip, but the Dutchman of Somali descent certainly was.