A car theft in the Netherlands, a seemingly insignificant note that was found in Molenbeek, and a shop for swimming pool equipment in the North of France. These are the three ingredients of the best clue there ever has been to thwart the Paris and Brussels attacks — a new investigation by the Belgian newspaper Het Laatste Nieuws reveals.
A lot has been written already about the clues that security services missed in the run-up to the Paris and Brussels attacks — clues that could have prevented the bloodshed by Islamic State. Could have. In hindsight, it is easy to list the mistakes. Yes, it was known to the police that Salah Abdeslam had started to radicalize. But at that time, it was the case with tens, if not hundreds of Belgian Muslims like him. And yes, only 22 days before the Paris attacks, a search took place in the house of Khalid El Bakraoui because he tried to obtain kalashnikov chargers. But he was known as a gangster and in the end no weapons were found.
Bayroshock without chlorine
About one clue, however, nothing has been published yet — and that clue is likely the very best chance authorities missed to detect the terrorist cell. It started with the theft of a car in a small village between the Dutch rivers Maas and Waal. It was a silver colored Audi S4 built in 2003 that disappeared in the night from August 10 to 11, 2015 at a parking lot in Rijswijk — part of the municipality of Woudrichem and not to be confused with the much bigger town of Rijswijk near The Hague. “Klerelijers”, a friend of the owner reacted at a notice on Facebook, using an equivalent for “assholes” that is endemic for the Netherlands — while another one hurled: “Your country will be proud of you”, easily assuming that the thief was of foreign origin.
The rightful owner got his car back after it was found in the Brussels municipality of Molenbeek, and during a subsequent house search a handwritten note was found. It seemed of little importance: “Bayroshock without chlorine”, it mentioned, followed by the addresses of two shops for swimming pool equipment in the North of France. Bayroshock is a product against algae that consists of hydrogen peroxide at a concentration of 34%. Apart from being recommended for the treatment of pools, that same substance is also a main ingredient of TATP. Triacetone triperoxide is the explosive often called ‘the Mother of Satan’ and known as a terrorist’s favorite since the failed attempt by ‘shoe bomber‘ Richard Reid to blow up a plane between Paris and Miami in December 2001.
The man in whose house the note was found, is Ahmed Dahmani — a naturalized Belgian citizen of Moroccan descent. He was born in 1989 in Al Hoceima, a town between the Rif mountains and the Mediterranean Sea. In 2015, he was living in a fourteen-storied building in the Molenbeek ‘Zone du Canal’ — not the kind of address where a swimming pool owner can be expected. He was mainly known to the judiciary as a multi-recidivist criminal, who was caught for theft already at the age of twelve. The latest of the 51 cases in which his name appeared, was about a massive traffic in hard drugs between Belgium, France and Luxembourg. But there were signs of radicalization too, much stronger signs in fact than those present at that time with his childhood friend Salah Abdeslam.
Blessing the expansion of Shariah4Belgium
With Abdeslam, he underwent an identity check on board of a ferry between Patras in Greece and Bari in Italy only a week before the car theft in the Netherlands. Now, we know that they conducted one of many travels along the refugee route that was used by the Islamic State to smuggle terrorists to the West, but then it understandingly did not raise a particular suspicion yet. Ten days after the search that uncovered the note, however, Dahmani was named in a report about radicalism. Written by a motorized patrol of the Brussels police that had apprehended a suspected candidate for the Syrian jihad. Friends of the suspect had tried rather brutally to prevent that arrest, and Dahmani was one of them.
At Facebook, Dahmani did not hide his beliefs. There, he complained in 2014 already that the word extremism was “invented by enemies of the Islam”, while posting a quote that the Islamic State often uses to recruit criminals like him for the jihad — the one in which the second caliph Omar ibn al-Khattab declared: “Sometimes the people with the worst past create the best future”. Dahmani also posted Islamic State videos, and three days before a terrorist attack was foiled in Verviers — in January 2015 — he threatened: “One day everything will be paid.” He did all of that under the cover of a pseudonym, but his contacts with a suspect in the Verviers case could have lead to his identification back then already.
In Dahmani’s family tree, radicalism became obvious almost a decade ago. His older brother Mohamed — who basically raised him instead of their always absent father and their chronically ill mother — was named in a terrorist case as early as 2009. He was investigated for his contacts with the suspects of a bomb attack in Cairo that killed a French teenager — the same suspects behind the earliest plot against the Bataclan in Paris. Mohamed Dahmani was never charged, but by the time his brother Ahmed entered the scene, at least three of Mohamed’s friends had left for Syria. One of them departed from Brussels in the company of the later terrorist commander Abdelhamid Abaaoud. And in 2012 already, Mohamed himself was known as a patron of Shariah4Belgium, asked explicitly for his blessings when leader Fouad Belkacem wanted to expand his recruitment from Antwerp to Brussels.
“Talking like youngsters, but not impolite”
Altogether, there were plenty reasons to raise the alarm when Ahmed Dahmani showed his interest in an ingredient for bombs. But that did not happen, and at the 8th of October 2015 — a month after the note of Dahmani was found — a BMW left Molenbeek towards the North of France. At 4h04 that afternoon, the car was caught by a speed camera at the A2 highway in Neuville-sur-Escaut. The license plate would later learn that the vehice was rented by Salah Abdeslam, and the GPS revealed two stops: at 5h02 in the rue Maurice Thorez in Saint-Sauveur, and at 5h44 in the rue Ferdinand de Lesseps in Beauvais — the two shops mentioned on Dahmani’s note.
Both are branches of Irri Jardin, a chain “for your swimming pool, irrigation and spa”. The shop in Saint-Sauveur had ran out of Bayroshock, it seems. But the Beauvais manager recounted to the police how he sold his entire stock that day. “I had three jerrycans of five liters each, and they asked for more. When I told that half a jerrycan is sufficient for one pool, they claimed that they did the maintenance of several pools in the Paris area. Then they asked for a similar product, which I couldn’t offer. ‘Let’s buy these three then, we have to leave’, one of them said. They paid with cash and didn’t look tense, only a bit in a hurry.”
The manager described the two men as North-Africans between 25 and 30 years old. Both were of average build, had short hair and a short shaved beard. One of them was wearing a jacket over his sweater, the other one a bodywarmer. They spoke French — also when they talked to each other — without a particular accent. “They expressed themselves like youngsters do, but they weren’t impolite”, the manager said. Confronted with the pictures of known suspects, he thought to recognize Salah Abdeslam. But he wasn’t sure. Altogether, the two men spent no more than seven minutes in his shop, after which they made a fuel stop at the Total station of Hardivillers and returned to Molenbeek.
Forbidden in Belgium now, but not in France
French investigators are fairly confident that their purchase has served to fabricate the bombs that were used for the attacks in Paris on the night of 13 November 2015. There were eight explosive belts, of which two have failed to detonate. Each of them contained between one and two kilograms of TATP, and according to explosives experts of the French police, the terrorists could make ten kilograms with fifteen liters Bayroshock. In Belgium, the EU directive banning the sale of hydrogen peroxide in concentrations above 12% to private customers was passed into law in July 2016. But in France, a softened version entered into force last year, just requiring registration for private purchases.
Ahmed Dahmani is in Turkish custody now. He took a flight in Amsterdam on the morning after the Paris attacks, with a ticket that was bought a few hours prior to the bloodbath — indicating that he knew what was going to happen. When he was arrested near Antalya on the 16th of November 2015, he was still in the possession of his Belgian documents, including membership cards of the Christian trade union CSC and the Grand Casino in Brussels. In the meantime, however, he had also bought a false Syrian passport with the name Mazen Mohamad Ali, and the WhatsApp conversations on his phone revealed that he had planned to reach the territory of Islamic State. In December 2016, a Turkish court convicted him to ten years and nine months in jail for membership of a terrorist organization. After he has served that sentence, Belgian and French extradition requests are awaiting him.
The terrorist cell behind the Paris and Brussels attacks apparently has kept its weapons and explosives for a while in a Belgian school. That can be concluded from a map on a laptop used by Salah Abdeslam — as we reported today in the Belgian newspaper ‘Het Laatste Nieuws’.
It was after the shooting during which Salah Abdeslam was able to escape on the 15th of March 2016, that a laptop was found in his safe house at rue Dries in the Brussels municipality of Forest. That HP EliteBook 8440p contained videos of extremist preachers, pictures of possible targets, information about weapons and military gear, but also a map that was titled ‘Salah’ — indicating that it was used by Abdeslam. Many files were erased, but computer specialists of the Belgian federal police were able to retrieve them, and by doing so they also discovered a rather remarkable map.
The hand-drawn map mentioned two street names: Saviostraat en Elzenstraat. A combination that only exists in Meulenberg, a neighborhood of Houthalen-Helchteren in the east of Flanders, infamous for its security issues and cases of radicalism. The buildings on the map turned out to be the local kindergarten and elementary school. Curious about what Islamic State terrorists were looking for at such a location, about twenty police officers went to Meulenberg on Saturday the 11th of June 2016.
They were armed with search warrants and in the company of Gorro, an explosives dog. The instructions written in French on the map led them along a first building, the regional center for student coaching, to the kindergarten’s playground. There, they found a hole cut in the fence, exactly at the place where was mentioned at the map: “Here you have to jump over”. The hole provided access to an overgrown piece of garden in which they found a ramshackle shed and a garage.
One of the doors in the garage showed traces of a burglary. But besides old school furniture, there was nothing found inside. The investigators left without any answers, but they did inform the State Security — Belgium’s intelligence service. That resulted in a confidential note on the 28th of July 2016 — a document that we have obtained. State Security found out that a former concierge of the sports hall next to the school was killed in Syria fighting for Islamic State. Younes Laabadi, 43 years old at that time, was linked by marriage to the family of Mohamed Abrini — the ‘man with the hat’ who had escaped alive during the Brussels attacks on the 22nd of March 2016.
Putting all the pieces together, the investigators concluded that the school domain has likely served as a weapon storage place. It is known that the terrorist cell possessed an arsenal of which at least four kalashnikov-type rifles, a riot gun, two pistols, two hand grenades and an amount of explosives were left after the massacre in Paris on the 13th of November 2015. Those weapons weren’t used for the Brussels attacks, and a intercepted conversation made clear that they had planned to hide the stash for later attacks.
That was reason enough for the investigators to conduct a second search on Wednesday the 10th of July 2016. Done by ten officers, with the explosives dog Jessy, and also in the sports hall this time. But again it was in vain. The assumption that the weapons have been hidden at the school remains however. “Considering the burglary traces, the possibilit exists that the weapons were retrieved and stored elsewhere just before the Brussels attacks”, the State Security document reads.
In the meantime, there are even strong suspicions of who has carried the weapons away to hide at another place — a location, by the way, that still isn’t found. According to the intercepted conversation, that assignment was given to a certain ‘Abu Imran’, described as “a brother who has been in Syria already”. That fits perfectly well with the profile of Bilal El Makhoukhi (28), a terrorist from Brussels already known as Abu Imran, who lost a leg while fighting for Islamic State. He already admitted having been in touch with the Brussels terrorist cell in the week before the attacks, while arrested terrorist Osama Krayem declared during one of his interrogations that he met El Makhoukhi in a safe house in Laeken.
It isn’t known how long the weapons possibly were hidden at the school domain. But it is a certainty that they posed a terrible risk. The suspicious garage is situated only twenty meters from the kindergarten, and even closer to the student coaching center. It is thought that the stash contained explosives of the types C4 and TATP. The first is both extremely powerful and hard to detonate, but the latter so unstable that it can explode by heat, friction or shock. That could easily have led to a devastating chain reaction causing lots of casualties.
The two men who are in a Belgian jail because they brought Paris suspect Salah Abdeslam back to Brussels, made suspicious journeys before. Hamza Attou went to the UK with a man of Iraqi descent only three days before the attacks, while Mohamed Amri visited Turkey at least seven times during the past two years.
Mohamed Amri (26) and Hamza Attou (21) belonged to the very first suspects who were caught after the Paris attacks. They quickly confessed that they had brought the only surviving perpetrator back to Brussels that night. On the phone, Salah Abdeslam reportedly said that he had suffered a car accident. It was only when they met him in Paris, that he told them about his role in the bloodbath. According to their declarations, he threatened to blow up Amri’s Volkswagen Golf if they refused to give him a lift.
Amri and Attou are still behind bars, but no details have surfaced yet about a further implication in the terrorist plot. When Molenbeek mayor Françoise Schepmans named the Paris suspects who were on a list of radicalized inhabitants prior to the attacks, she did not mention these two. In the 55 pages long report that the Paris police has written about the attacks for the French Interior Minister Bernard Cazeneuve however, it is stated that the Belgian authorities knew Amri already as “being close to the movement of the extremist Islam”.
That same report also reveals how both Amri and Attou undertook suspicious journeys in the days and years before the Paris attacks. Airline registers learned that Amri went to Istanbul at least seven times between May 2013 and May 2014. When returning, he often flew to other destinations than his home town Brussels — such as Paris, Marseille, and Copenhagen. The report contains no proof that his travel was related to terrorist activities, but they happened at a time when Turkey served as the main gate to Syria for tens of members of the network behind the Paris and Brussels attacks.
Hamza Attou left Belgium on the 10th of November 2015 for a journey to the UK. He did so in the company of a man from Brussels with roots in Iraq, and a Dutchman of Somali descent. It was the latter who drove the Ford Focus with Dutch license plate when they boarded the ferry from Dunkerque to Dover. Their tickets were booked by an autochtonous Dutchman we could reach and who provided some background about the trip.
He told us that the Dutchman of Somali descent is a youth friend who wanted to visit relatives in the UK. “On the internet, he searched for people who would join him in order to share some of the costs. That’s how he came into contact with the men from Brussels. He did not know them at all prior to that England trip.” Reportedly, the trio was stopped in the UK because something was wrong with the identity papers of one of the Brussels men. But what exactly was the problem, is not known — and neither is how long they were held.
The men from Brussels did not travel back together with the Dutchman, but if they did so with their initial reservation, they came back the very same day as the Paris attacks. Again, the French police report does not allege that their stay in the UK was somehow linked to terrorism. The Brussels man of Iraqi descent, 43 year old A.J.I.H. seems to have relatives living in London, which can mean there is a completely innocent reason for visiting the UK. We do not know whether he was interrogated about the trip, but the Dutchman of Somali descent certainly was.
The suspect of the Paris attacks identified on Monday as the mysterious ‘Soufiane Kayal’ is a Belgian citizen for whom an international arrest warrant was issued already in 2014. That did not prevent him to return from Syria and supposedly serve as bomb maker for the terrorist plot.
Najim Laachraoui, a Belgian citizen born on the 18th of May 1991 in the Moroccan town of Ajdir, but raised in the Brussels municipality of Schaerbeek. That’s the true identity of Paris suspect Soufiane Kayal, according to a public statement of the Belgian Federal Prosecutor’s Office.1
Early in December of last year, a wanted notice was distributed for Kayal and his companion Samir Bouzid2, stating that their names were false, but that both men were present in the car of Paris suspect Salah Abdeslam during a control at the Hungarian-Austrian border on September 9, 2015.
On the 5th of October, the passport of Kayal was used to rent a house in Auvelais, in the southern Belgian province of Namur. A house that was subsequently used by several of the Paris suspects. Apparently it was meant to store explosives, since a perfectly dry basement was asked.
It was thought for quite some time that Kayal and Bouzid only have had a limited role in the logistics of the attacks. But a reconstruction of the telecommunication between all different actors learned that they coordinated the attacks in real time from somewhere in Brussels.
According to a detailed account that CNN has compiled, Kayal and Bouzid were even the ones who directed Abdelhamid Abaaoud’s niece to his initial hiding place. Compared with the man who long was named as mastermind of the Paris attacks, investigators stated about Kayal and Bouzid: “They outranked Abaaoud”.3
In hindsight it seems odd that it took so long to identify Kayal, since Laachraoui is one of 30 defendants at a terrorist trial that started in Brussels a month ago. All the accused belong to the network of Khalid Zerkani, the very same jihad recruiter who has sent Abaaoud to Syria.
Laachraoui left for Syria himself in February, 2013. Investigators say that he became responsible for the reception of new recruits, and for that significant role within the terrorist group Islamic State, the maximum of 15 years in jail was asked against him. The verdict is expected in May.
It is in the official complaint for the so-called case ‘Zerkani-bis’ (the first trial concluded last summer and convicted Abaaoud to 20 years in jail) that the two year old international arrest warrant against Laachraoui was revealed. More precisely, it was issued on March 18, 2014.
For Laachraoui — who is also known as ‘Abou Idriss’ — that wasn’t an obstacle for his return. Chances are high that he has served as the bomb maker for the terrorist plot. Apart from the house in Auvelais, his DNA was also found on two of the explosives belts that were used in the Paris attacks.4
His DNA was also found in the Schaerbeek apartment where the bombs reportedly were made, and Laachraoui was skilled for the job. When he finished secondary education at the ‘Institut de le Sainte Famille d’Helmet’ in Schaerbeek, he went on to study electromechanics.5
1An updated wanted notice was published here: http://www.police.be/fed/fr/avis-de-recherche/recherches/suspects-connus/1203497-najim-laachraoui
2Samir Bouzid was recently identified as Mohamed Aziz Belkaid, an Algerian with residence in Sweden. He was killed during a counter-terrorist operation in the Brussels municipality of Vorst on March 15, 2016
5See on page 12 of this school magazine: http://www.sainte-famille.be/telechargements/maillon116.pdf