Belgium and Paris SNA of a Terrorist Organization

1. Visualizing a Network From
Open Sources
Uncovering (and Visualizing) Links
Between the Brussels and Paris
Attackers, Inferring the Missing Pieces

4. Open Source Analysis
• Lots of data from open sources in multiple formats
• Dataset emerges over prolonged period of time from multiple
sources.
• No dataset complete
• No dataset easy to analyze “as is”
– Approach inspired by Valdis Krebs, “Uncloaking Terrorist Networks” –
published after 911.
http://firstmonday.org/ojs/index.php/fm/article/view/941/863
• Research Question 1 - What can we assess about the Paris-Brussels
attacks from open sources using the same approach?
• Research Question 2 – Can we detect missing links?
• NY Times story on 9Apr2016 is the Point of Beginning (POB)…
– http://www.nytimes.com/interactive/2016/03/23/world/europe/how-
the-brussels-and-paris-attackers-could-be-connected.html

5. One of the key connections between the two groups is Najim
Laacharoui, the second suicide bomber at the Brussels airport,
who made bombs used in both the Brussels and Paris attacks.

6. At least 14 individuals tied to both attacks were either Belgian or lived in
Brussels. A number of the Paris assailants spent time together in Molenbeek, a
working-class Brussels district. Salah Abdeslam, the only surviving direct
participant in the Paris attacks, was able to hide among family and friends in
Molenbeek before his arrest on March 18.

7. Many of the identified assailants in both plots had criminal backgrounds. Abdelhamid
Abaaoud and Ibrahim Abdeslam spent time in the same Brussels prison. The Bakraoui
brothers had been sentenced to prison for violent crimes, including carjacking and bank
robbery.

8. Many of the individuals directly involved in the Paris attacks had traveled to Syria.
Ibrahim el-Bakraoui was deported by Turkey back to Europe last year, suspected of
being a terrorist fighter trying to enter Syria, Turkey’s president said.

9. Several of the Paris assailants had ties to terrorism that were known by the authorities
before the attacks. Abdelhamid Abaaoud, for example, has been linked to several earlier
plots. The federal prosecutor in Belgium said that an arrest warrant had been issued for
Khalid el-Bakraoui in December by the judge investigating the Paris attacks.

10. Fingerprints of at least three Paris attackers were found in apartments rented by two
of the Brussels bombers. Salah Abdeslam’s fingerprints were found in a Brussels
apartment rented by Khalid el-Bakraoui and another one rented by Najim Laachraoui,
who used it as a bomb-making lab. The fingerprints of two other Paris attackers, Bilal
Hadfi and Abdelhamid Abaaoud, were found in a safe house, also rented by Mr.
Bakraoui.

11. Many were of Moroccan descent or had relatives there. The parents of Abdelhamid
Abaaoud, the suspected chief planner of the Paris attacks, were Moroccan immigrants to
Belgium. The father of the two brothers in the Brussels attacks was a devout Muslim who
had also emigrated from Morocco.

12. The assailants carried out most of the attacks in Brussels and Paris in groups of two
and three. Salah Abdeslam had planned to help carry out attacks at the stadium in
Paris, but backed out. Abdelhamid Abaaoud is believed to have been one of the
assailants at the restaurant in Paris.

13. Synopsis
Lost in the details yet?

14. Geographic Clues: Sites Related to Paris and Brussels
Fingerprints of two Paris attackers were found in a house in Charleroi, near the French
border. The house is believed to have been rented by Khalid el-Bakraoui, one of the
Brussels attackers. DNA traces of Najim Laachraoui, a bombmaker involved in the Paris and
Brussels attacks, were found in another house in Auvelais.

17. Ops TTPs
• Extensive use of social media platforms such as Viber,
Telegram and WhatsApp, many encrypted for secure
communication
• Give operatives only as much information and money as
they need to reach the next phase; contacting them on
each leg of their journey; and insisting on pseudonyms,
even within teams.
• Constantly exchanged logistical advice with others in their
network, including whether or not to use real names at
border crossings and how to sneak across those borders
illegally. One tip was to hide in train restrooms.
– Used fake Syrian passports
– Posed as Syrian refugees

18. 2 Dead and 2 Arrested
Adel Haddadi Muhammad Usman
Ahmad al-Mohammad Mohamad al-Mahmod

19. “two suspected operatives?”

20. Two “Colleagues” Captured in Austria and Later Linked
to Two of the Previously Unknown Attackers
Ahmad al-Mohammad
Mohamad al-Mahmod

22. Finally as a network…(again)
I took their series of graphics and built a NODEXL version. The NYTimes graphic was at:
http://www.nytimes.com/interactive/2016/03/23/world/europe/how-the-brussels-and-paris-attackers-could-be-connected.html
Abu Ahmad
Ahmad al-Mohammad
Mohamad al-Mahmod

23. 3rd Survivor - Abid Tabaouni
• Tabaouni traveled from Syria along the refugee route
• Tabaouni arrived, Austrian security officials thundered into the center,
arresting Haddadi, Usman and a few others suspected of being connected
to the Paris attackers.
• Tabaouni had programmed his phone with a number linked to the terror
cell of the ringleader of the Paris attacks, Abdelhamid Abaaoud.
• Haddadi denied knowing Tabaouni.
– Tabaouni had saved Haddadi's phone number in his contacts.
• Tabaouni was also part of the same plot - arrested in Brussels in July.
• Tabaouni was using a Facebook account that is identified by its unique ID
number and was publicly posting updates from Belgium
• Haddadi and Usman were extradited to France
• Probably more sleeper cells and ISIS operatives coming into Europe using
the same crowded, chaotic refugee route (COSMIC INSIGHT!!)

24. Connected??
• Abdelhamid Abaaoud contacts
– Reda Hame, recruited for IT expertise
– Ibrahim Boudina, part of a cell of 22 men radicalized
at a mosque in Cannes
– Mehdi Nemmouche – killed 4 at the Jewish museum
of Belgium
– Faiz Bouchrane – caught in Lebanon; in custody
– Ayoub El Khazzani – caught by US troops on vacation
on high speed train
– Dozens of others arrested in France, Spain, Belgium
and Germany

26. Key OS Research Links (some of)
• http://www.cnn.com/2016/09/05/politics/isis-suspects-
terrorism-europe-documents/
• https://www.washingtonpost.com/world/europe/official-
paris-gas-canisters-suspect-pledged-loyalty-to-
is/2016/09/09/efb70dca-766d-11e6-9781-
49e591781754_story.html
• http://www.nytimes.com/2016/03/29/world/europe/isis-
attacks-paris-brussels.html
• http://www.nytimes.com/interactive/2016/03/23/world/e
urope/how-the-brussels-and-paris-attackers-could-be-
connected.html
• http://www.wsj.com/articles/terror-networks-web-sprawls-
beyond-brussels-and-paris-1459124085

29. >70% of Americans now have a smartphone…and
spend nearly 2 hours a day on social media

31. Social Media Sites

32. What Do You See Here?
Any Given Moment in a Large City

33. What Do You See Now?
Any Given Moment in a Large City