On November 21, 2016, French Interior Minister Bernard Cazeneuve announced that a large-scale terrorist attack in the Paris area had been foiled following the arrest of seven men on the night of November 19-20 in the cities of Strasbourg and Marseille. (1) Five were kept in custody: Yassine Bousseria, Hicham Makran, Sami Ben Zarroug, and Zacaria M'Hamedi, all French nationals, were detained in Strasbourg, and Hicham el-Hanafi, (2) a Moroccan with a resident permit issued in Portugal that had been previously flagged (3) by a partner country, was detained in Marseille.
Initially, public attention was focused on the group of four detained in Strasbourg. According to information provided by Paris prosecutor Francois Molins, two of them had traveled to the border region between Turkey and Syria, and following their return to France, they received instructions through encrypted communication devices from Syria. "The Strasbourg cell had instructions to get weapons, given by a commander in the Iraq-Syria zone," Mr. Molins said. (4) During searches of their apartments, authorities found guns and a 12-page notebook with manuscript references to jihad and the Islamic State leader Abu Bakr al-Baghdadi. (5) French police believed they had uncovered a sleeper cell waiting for orders. (6)
During the following months, however, judicial and intelligence cooperation between several European countries led investigators to revise their thinking. They came to believe that the most important suspect was the man detained in Marseille, Hicham el-Hanafi. Their detailed analysis of his activities, travels, contacts, and finances revealed what seemed to be an undercover network of Islamic State operatives that spread throughout Europe and was financed through a credit-card fraud scheme. (7)
El-Hanafi, they concluded, had direct contact with previously identified members of the Islamic State's external operations department as well as links to the network responsible for the November 2015 terrorist attacks in Paris. (8) Two years later, he is still awaiting trial.
This article is the result of months of joint investigative reporting by a group of journalists from four European countries (a) and is based on thousands of pages of judicial documents, investigative files, interviews with key witnesses, and several counterterrorism and intelligence officials. It reveals how European cooperation led to the dismantling of a network that was preparing an attack in France, and examines the loose ends that are still under investigation, including the alleged role of Abdesselam Tazi, a mysterious man currently held in Portugal.
Entry to Europe
Hicham el-Hanafi was born in Fez, Morocco, on July 16, 1990. (9) Up until his early 20s, he showed no signs of radicalization nor was he particularly religious: he drank with friends, smoked, had girlfriends, and worked as a chef in a Turkish restaurant. (10) According to his family, he started to change in 2013 when he met Abdesselam Tazi, a then 59-year-old former policeman. (11) They bonded and together left Morocco on September 8, 2013.
El-Hanafi's brother Amine recalls meeting Tazi as the duo was about to depart. "It was the first time I saw him. He told me not to worry because he would take care of my brother the best way possible," Amine told the author. (12) Tazi and el-Hanafi took a bus to Agadir and then proceeded to Mauritania, Senegal, and finally Guinea-Bissau. There, on September 23, 2013, they boarded a TAP flight to Portugal using forged documents. (13) El-Hanafi carried a Romanian residence permit under his own name while Tazi had a French passport under the name of Pascal Fernand Joseph Dufour. (14)
Questioned by the border patrol agents at Lisbon airport, each of them immediately asked for asylum, saying they had been persecuted in Morocco for their political views and activities in support of the February 20 movement, (15) (b) which was calling for democratic reforms. According to authorities, the two never mentioned that they knew each other.
For a week, they stayed at temporary facilities at the Lisbon airport. They were then sent to the Refugees Housing Center at Bobadela, on the outskirts of Lisbon. In late November 2013, they were dispatched to a social security installation in the district of Aveiro in northern Portugal and received provisional resident permits that allowed them to travel freely. Their permanent residence authorization was issued in September 2014, valid until October 2019. (16)
For months, they managed to keep themselves under the radar. They rented a room in Aveiro (17) and traveled freely to several European countries, mostly Spain, France, and Germany. (18) They also seemed to have financial resources not compatible with their refugee status, as a part of which they received a small monthly allowance of 150 euro. (19)
It was only in early 2015 that their activities came to the attention of Portuguese authorities, following a complaint submitted by Hicham el-Hanafi's brother, Amine. (20) The two had not seen each other for almost two years. But when he moved to Lisbon, Amine immediately realized that his younger brother had changed: Hicham was strictly following what he saw to be his religious duties; he refused to greet his female cousin because she was not properly dressed, and every conversation would inevitably end in a discussion about jihad and the war in Syria. (21) Amine's suspicions quickly became certainties. First, there was a long conversation he took part in with other Moroccans at Porto airport in which Hicham el-Hanafi and Abdesselam Tazi made clear that they believed that every Muslim had an obligation to perform jihad. Second, Hicham revealed to Amine that he had spent two months in Syria receiving "military training from Islamic State affiliated groups" in late 2014. (22) "I tried to persuade him, but it was too late," Amine told the author. (23) But it was only when Amine became aware that Hicham had managed to convince their mother and four younger sisters to travel to Syria that he decided to contact Portuguese authorities. (24) Amine also testified that Abdesselam Tazi was responsible for his brother's radicalization and that both had managed to convince at least two other Moroccan refugees in Portugal to join the Islamic State in Syria. (25)
On July 30, 2015, Portuguese Judiciary Police opened an offcial investigation into the activities of Hicham el-Hanafi and Tazi for suspicion of terrorism. (c) The investigators quickly realized that both men had been spending most of their time outside Portugal, and authorities issued a request for discreet surveillance under the Schengen Information System. (26) Nothing came up to indicate their whereabouts for three months. Then in October 2015, the pair popped up in the city of Wuppertal, Germany, when they used their bank cards to withdraw the 150 euro they received that month from Portuguese social services.
In the following months, their presence was detected in several European towns and cities: Paris, Amsterdam, Hamburg, Frankfurt, Bremen, Dusseldorf, Hagen, Brussels, Manchester (where they were prevented from entering the United Kingdom at Manchester airport due to the use of false documents and were sent back to Germany (d)), Istanbul, Athens, and Tirana. They also made a mysterious journey to South America where Tazi visited Brazil, Nicaragua, Guatemala, Panama, Honduras, and El Salvador. (27)
Each time they returned to Portugal, Tazi and el-Hanafi were the subject of close surveillance by teams of the Unidade Nacional de Contra Terrorismo of the Judiciary Police and also from Servico de Informacoes de Seguranca (SIS), Portugal's domestic intelligence agency. When back in Portugal, the two men frequented the northern region, where they spent thousands of euro on mobile phones, clothes, and shoes, and had medical treatments they paid for with forged credit cards. (28) According to Portuguese authorities, the two used the money obtained from the sales of those goods to finance the successful travel of two Moroccan nationals who had obtained asylum in Portugal--Abderrahmane Bazouz and Abdessamad Anbaoui--to Syria, where they joined the Islamic State. (29)
International cooperation also started to produce results. In early 2016, Belgian authorities informed the Portuguese police that in April 2015, Tazi had received two wire transfers: one for 3,295 euro was sent by a certain Chakhir Haddouchi and another for 1,445 euro was sent by a man named Salaheddine Lechkar. (30) Haddouchi's address in Brussels was the same as that of two Belgians included in the list compiled by Belgian authorities of jihadis who traveled to Syria: Aberkan Abdelhouaid and Aberkan Abdessamad. (31) According to information provided to the author by intelligence and counterterrorism officials, (32) Chakhir Haddouchi is the brother of Anouar Haddouchi, (33) a Belgian jihadi whose bank account in the United Kingdom was the source of 3,000 British pounds withdrawn between May and June 2015 and handed in July 2015 to Mohamed Abrini (34)--the so-called "man in the hat" in the March 2016 Brussels airport bombing who has been charged for his role in the Islamic State cell behind that attack and the November 2015 Paris attacks. (35) Salaheddine Lechkar, for his part, is considered a person of interest by European authorities because of his possible connections to an Islamic State financial middleman based in Turkey. (36) Lechkar's current whereabouts are unknown to authorities. (37)
An Undercover Operation in France
In the summer of 2016, the Portuguese investigation came to a halt. For months, there had been no sign of Tazi and el-Hanafi. Due to a lack of communication among European Union member states, the Portuguese did not learn until November 2016 that in June 2016 Tazi and el-Hanafi had been...