Attempting to understand the Paris attacks

This piece is the first installment in a three-part series examining last month’s terrorist attacks in Paris. The second and third installments can be found here and here, respectively.

While the news media have moved on to other mayhem and murders, efforts to fully understand the recent terrorist attacks in Paris continue. As is always the case in such investigations, a lot of what has been reported is not supported by evidence. Although much of the reporting may turn out to be wrong, it quickly becomes well-established in the public’s mind — in the absence of complete information, lore becomes fact. The investigation will eventually fill in some of the gaps in our knowledge of the events leading up to the attacks in Paris, but some questions will remain unanswered. Embedded in the unknowns are some of the chronic dilemmas faced by counterterrorist authorities everywhere.

Despite the claim of one of the terrorists, Cherif Kouachi, that he was sent by al Qaeda in the Arabian Peninsula (AQAP) to carry out the attack on the offices of Charlie Hebdo, we do not know what role AQAP really played in the attack. Connectivity in the jihadist universe is always murky, and our knowledge is limited.

Both Cherif Kouachi and his brother Said had previously been under surveillance for years by French authorities, but the surveillance was suspended when the brothers did nothing to warrant continued attention. How can authorities know who will become an active terrorist? What triggers the terrorists’ actions? How long must suspects be monitored before they can be safely judged to not pose an imminent threat? With large and growing numbers of suspects and limited resources, what is the best strategy for preventing terrorist attacks?

The al Qaeda connection

Calibrating the role of foreign terrorist organizations in domestic terrorist attacks is always a challenge. Al Qaeda’s central command has in the past planned and supported specific terrorist attacks, recruiting and deploying operatives, communicating with them during preparations, and providing continuing financial support. The 9/11 attacks were an example of continuing direction.

Facing a more hostile operating environment after 9/11, continuing connections between al Qaeda organizations in domestic operatives became more difficult, and command became looser. In several cases, al Qaeda or one its affiliates recruited operatives, equipped them with explosive devices, and dispatched them on assassination or sabotage missions. The case of Umar Farouk Abdulmultallab, the so-called “Underwear Bomber,” is an example.

In other cases, al Qaeda offered volunteers who managed to reach its training camps instruction and guidance but provided no material support and only limited direction to any actual operation. An example would be the 2009 plot to bomb New York’s subways. Three volunteers from the United States traveled to Afghanistan with the intention of joining the Taliban. They were recruited by al Qaeda instead and were given weapons training. Two stayed on to learn how to make bombs. Their mission was to carry out terrorist attacks in the United States after their return, but target selection and operational planning were left to them.

{mosads}As al Qaeda increasingly embraced do-it-yourself jihad, its communicators relied on the Internet to persuade individuals to carry out attacks on their own, without precise guidance or assistance. Army Maj. Nidal Hasan, who shot and killed 13 soldiers and wounded 29 others at Fort Hood, Texas, in 2009, drew inspiration from his email exchanges with Anwar al-Awlaki, an American citizen who moved to Yemen and joined AQAP in 2004, but Hasan carried out his attack on his own initiative.

Finally, some would-be terrorists have no interaction with al Qaeda but regard themselves as its operatives and may claim affiliation. Carlos Bledsoe, an American who in 2009 shot two soldiers at an Army recruiting center in Little Rock, Ark., spent 16 months studying and teaching English in Yemen. Like Cherif Kouachi, Bledsoe claimed that he had been sent to carry out his mission by AQAP, but his claims of affiliation were vague, and although police found literature from al-Awlaki in Bledsoe’s car, there is no evidence of contact with the group. As in the Kouachi case, U.S. authorities were aware of Bledsoe’s time in Yemen and interviewed him both in Yemen and several times after his return to the United States, but they found nothing suspicious and he was not kept under surveillance.

Cherif Kouachi, talking to the news media during the hostage siege in Dammartin-en-Göele that ended with his death, claimed that AQAP (known in France as al Qaeda de Yemen) planned and financed the operation in Yemen, which Kouachi said he visited in 2011.

Kouachi said that while in Yemen, he met AQAP commander al-Awlaki. Al-Awlaki had already been identified by U.S. intelligence sources as an operational planner in addition to his role as skilled propagandist and charismatic communicator. He created AQAP’s slick online magazine Inspire, which offered ideology and terrorist instructions along with jihadist adventure stories aimed at an audience of young men eager to participate, at least vicariously, in al Qaeda’s global jihad. He also inspired a number of homegrown attacks and plots in the United States, including the Hasan shooting at Fort Hood and the attempted bombing of New York’s Times Square in 2010.

AQAP has been the most active of al Qaeda’s affiliates in sponsoring terrorist attacks against the West. In 2009, it recruited and equipped the Underwear Bomber to sabotage an American airliner flying to the United States. AQAP was also behind a sabotage attempt aimed at two air courier flights to the United States in 2010, along with a third, foiled sabotage attempt in 2012. In 2009, the group attempted to assassinate the recently designated Deputy Saudi Crown Prince and Minister of the Interior Muhammad bin Nayef. It also tried unsuccessfully to assassinate the British ambassador to Yemen in 2010 and is responsible for other attacks on foreign nationals in Yemen.

According to a number of media accounts published days after the attack on Charlie Hebdo and now well-established lore on the Internet, in 2009, Said Kouachi traveled on a student visa to Yemen, where he befriended Abdulmutallab, who was there at time being prepared for his suicide mission. Based on sources in Yemen, media accounts reported that Said Kouachi remained in Yemen until mid-2010, but returned later in the year and stayed through most of 2011, when his brother Cherif joined him. French authorities say this is not true.

The point is not to criticize the reporters who, under pressure to find out just who the Kouachi brothers were and how they came to be killers, reported what sources in Yemen told them. Intelligence services face the same problem. Much of what they know comes from sources that make mistakes or sometimes fabricate. Intelligence agencies presumably have more and better sources, but there are examples of information reaching the White House that turns out to be wrong.

Another Yemeni source, speaking after the attacks in Paris, also put both Kouachi brothers in Yemen, but only between July and August 2011. French authorities accept this timeframe, but not the presence of both brothers. They point out that Cherif, who was under judicial supervision, could not leave France; however, they consider it possible that Cherif traveled to the Middle East using Said’s passport, which put him in Oman in July 2011. From Oman, Cherif, pretending to be Said, could have easily traveled to Yemen, where he spent several weeks. French services learned about this trip in November 2011 and, as a precaution, put both brothers under surveillance.

The French services have no indication that Cherif Kouachi met al-Awlaki while he was in Yemen, but they believe that he probably met a French citizen staying in Yemen who was considered to be close to AQAP. (This may explain the confusion about whether both brothers were there.) French authorities accept the possibility that while he was in Yemen, Kouachi was sensitized to the designation of Charlie Hebdo as a top al Qaeda target, but the brevity of the trip suggests that AQAP did not invest heavily in training him or planning an operation.

However, AQAP’s own spokesman later backed up Kouachi’s declaration, saying that AQAP had sponsored and supported the attack, but he provided no details and offered no evidence to support the claim. Christophe Crepin, a French police union official, stated that French authorities were seeking several people in connection with the “substantial” financing of the gunmen behind the terror campaign, while American television networks reported that Kouachi returned from Yemen with $20,000 from AQAP, which seems like a lot of money. It is possible that AQAP gave Kouachi some money, which he could have brought with him when he returned to France, but there is absolutely no evidence that he did so, and the amounts reported in the press seem improbable. French authorities also have no evidence of him having received any money from AQAP after his return, nor is there any evidence of communications with AQAP while the brothers were under surveillance. What the surveillance entailed has not been revealed.

Cherif Kouachi’s claim gave al Qaeda a propaganda triumph over its rival, the Islamic State in Iraq and Syria (ISIS), which seemed to be getting all of the attention at the time. Cartoonists who insulted the prophet, like those at Charlie Hebdo, were at the top of the jihadists’ hit list, and it looked as if AQAP jumped at the chance to claim credit. Since Kouachi had visited Yemen, where he probably discussed terrorist operations, the claim can be accepted as true in the most general sense.

Charlie Hebdo had been high on the jihadists’ target list since 2006, when it first published a cartoon of the Prophet Mohammad. Other cartoons followed. This disrespect to the prophet enraged al-Awlaki, and in 2010, he authored a fatwa calling for the death of a cartoonist in Seattle whom he felt had produced such an insult. He also threatened other cartoonists and authors in Britain, Sweden and the Netherlands. The appropriate punishment for insulting the prophet, he wrote, was death.

What remains questionable is AQAP’s connection with the Kouachi brothers after 2011. If the plan to attack Charlie Hebdo was hatched in 2011, more than three years before the assault, why the long wait? What were the brothers doing all this time? Did the link end with their return to France or with al-Awlaki’s death by an American drone strike in September 2011, or were there continuing communications that the French missed? Did the brothers inform AQAP of progress in their planning? Did AQAP send money after Cherif Kouachi’s return to France? AQAP has provided no details and offers no evidence to support its claim of responsibility.

Even before Syria’s civil war began to attract thousands of foreign fighters, Westerners traveled abroad to connect with jihadist groups in Afghanistan, Pakistan, Somalia, Yemen and elsewhere. These volunteers may come through trusted channels, with endorsements from other individuals known to the groups, but they are all what intelligence services call “walk-ins” — not trusted operatives who come up through the ranks of an organization or high-ranking defectors offering secrets, but amateurs offering their services. Al Qaeda and its affiliates have effectively exploited them on some occasions, including the 2005 attack on London’s transport system and the 2009 plot to blow up New York’s subways. In the latter case, the leader of the plot renewed his contact with his bomb-making instructor, which led to the plot being uncovered and the arrest of the conspirators.

By 2011, al Qaeda’s affiliates were increasingly worried about infiltrators sent to gather intelligence and foil operations. Possible spies pose less of a problem for terrorist groups than do intelligence services. Doubtful walk-ins can be given menial tasks — some have complained about this — or can be recruited for suicide missions. The group can offer more-promising candidates basic weapons training, teach them how to build simple bombs, perhaps give them some money and send them back to their home countries without prospects of further contact or control over their directions — like wind-up mice.

The returning terrorists are not always reliable. The Underwear Bomber’s device failed to work because he had worn the underwear for two weeks, degrading the explosive. The next person sent by AQAP to sabotage an aircraft, in 2012, turned out to be a Saudi plant. To ensure that the assassination of the Saudi deputy crown prince would be carried out, the bomb maker had to employ his own brother as the assassin. The brother was killed in the attack; the prince survived. We have no way of knowing how many individuals have been trained and dispatched by al Qaeda or AQAP but never completed their missions.

In no case do we have evidence of AQAP handing over significant sums of cash on the promise to carry out an attack, as some media sources have claimed. Whether the terrorist training-camp “graduates” will in fact carry out an operation is unpredictable. The very small number of terrorist attacks in the West, most of which have been homegrown and self-financed, would suggest that this does not happen often. Providing volunteers with training and resources must be seen as a low-yield investment for a terrorist organization.

For the foreign volunteer, however, even a short time with a real terrorist group can provide a sense of belonging, direction and legitimacy. Years after his trip to Yemen, facing almost certain death, Cherif Kouachi declared himself to be a warrior of AQAP, carrying out an act of justified revenge on the orders of his long dead commander. Powerful stuff.

Was Amedy Coulibaly the instigator?

On the evening of Jan. 7, 2015, while French police were searching for the Kouachi brothers, a third gunman seriously wounded a jogger. The next day, a gunman shot and killed a policewoman and wounded a street sweeper. On the afternoon of Jan. 9, an armed man seized hostages at a kosher supermarket and demanded the release of the Kouachi brothers, who had that morning been located and surrounded by police. We now know that the shootings were all by the same man, Amedy Coulibaly. Before he was killed by police, ending the siege, Coulibaly killed four of the hostages.

While in prison for bank robbery in 2004, Coulibaly adopted a radical version of Islam and became a proponent of al Qaeda’s radical jihadist ideology. It was there that he also met Cherif Kouachi. The two remained close and continued their involvement in jihadist activities. In 2013, Coulibaly was arrested for plotting to break out one of the key figures imprisoned for his involvement in a series of bombings in Paris in 1995. The Kouachi brothers were also involved in the plot. The court sentenced Coulibaly to five years in prison, but he was released after serving only a few months.  

The brief time in jail did not alter his trajectory. He continued to plot terrorist attacks and claimed to have financed the Kouachi brothers’ attack on Charlie Hebdo. The claim was made in a video released after Coulibaly’s death at the supermarket. In the video, which appears to have been recorded just after the Charlie Hebdo attack, Coulibaly also asserts his allegiance to ISIS.

In some respects, Coulibaly’s murderous rampage, ending with his attack on the supermarket, looks unplanned, but subsequent investigations show that he was clearly preparing for some kind of a terrorist operation. At a residence he rented just a month before the Paris attacks, police found an impressive arsenal of weapons and explosives. Just days before the attacks, Coulibaly drove his common-law wife, Hayat Boumeddiene, to Madrid and remained with her until she boarded a flight to Turkey on Jan. 2. On Jan. 8, she crossed the border from Turkey into Syria.

Connectivity, again, is murky. We search for masterminds. In his video, Coulibaly claims his allegiance to the leader of ISIS, but French authorities do not believe that ISIS directed the attack. ISIS made no claim of responsibility, although it praised his attack, and the video was edited subsequent to Coulibaly’s death and posted online by a self-described ISIS spokesperson who identified Coulibaly as “a soldier of the caliphate.” Weeks after the attacks, Coulibaly’s wife gave an interview that was published in ISIS’s online French-language magazine. Her flight to Syria and her reception by ISIS hint at some degree of prior contact.

Coulibaly’s pledge to ISIS and Cherif Kouachi’s claim to be operating on behalf of AQAP do not constitute evidence that the two organizations are cooperating in attacks abroad. Coulibaly and the Kouachi brothers became committed jihadists and Cherif Kouachi traveled to Yemen before the split between al Qaeda and its rebellious progeny cleaved the jihadist universe. Neither group is likely to have directed the attacks.

The competition between al Qaeda and ISIS for leadership of the global jihadist movement has not yet extended into the ranks of would-be jihadists in the West. While fighters from Jabhat al-Nusra — al Qaeda’s local affiliate in Syria — and ISIS are killing each other, homegrown jihadists welcome the schism, hoping it will lead to competition between the two factions that will result in more local attacks. And unlike the Spanish Civil War, where Republican forces and their foreign volunteers got caught up in the deadly quarrel between Soviet leader Joseph Stalin and the Trotskyites, neither organization has command over the host of homegrown jihadists.

Homegrown terrorists are just that — homegrown. The push for action comes from below. It does not wait for direction from above. A sense of connection is important. Volunteers seek assistance from anyone who may provide it. More important is validation. (Undercover operations in the United States exploit this, offering would-be warriors the attachment they seek.) Loyalties are fluid. While Cherif Kouachi remained true to AQAP, Coulibaly preferred to fly under the black flag of ISIS, which has effectively marketed its logo as an emblem of commitment to its own form of unlimited violence in the name of God. More attacks will be carried out under its banner without it having any physical connection with the attackers.

Jenkins is senior adviser to the president of RAND Corporation. Clair was deputy director of the Directorate of Territorial Surveillance (DST), France’s internal security service, from 1998 to 2007; from 1983 to 1997, he led the Anti-Terrorism Branch of the DST.