Just hours after two ISIS suicide bombers blew themselves up inside Brussels airport on the morning of March 22, 2016, Belgian police discovered their safe house/bomb factory, thanks to the testimony of the taxi driver who picked up the attackers and took them to the airport.
In a trash can outside the residence on rue Max Roos in the Brussels district of Schaerbeek, Belgian police found a discarded laptop belonging to one of the suicide bombers — a Belgian named Najim Laachraoui — who is believed to have built the bombs used in the Paris and Brussels attacks.
Although much of the hard drive had been wiped clean, weeks of painstaking digital forensic analysis by the Regional Brussels Computer Crime Unit yielded a treasure trove of new information on the ISIS network behind the November 13, 2015, Paris and March 22, 2016 Brussels attacks (which included a bombing of the city’s subway system), according to Belgian investigative files obtained by CNN.
While some of the contents of the computer have been previously reported by CNN and other news outlets, this story, based on a 12-page Belgian police report of the laptop’s contents, provides the fullest account so far.
Among the revelations is that following the Paris attacks, Laachraoui, from Brussels, consulted with an ISIS bombmaker linked to the ISIS external operations division in Syria, to improve on the explosive recipe he had used to build the suicide vests worn by the Paris attackers. In addition, a number of audio recordings were recovered from the computer in which Laachraoui briefed a senior ISIS operative on every aspect of their attack-planning.
Investigators say the terrorist cell communicated with ISIS in Syria via encryption apps, providing an umbilical cord between the terrorist organization and the Paris and Brussels attack teams that allowed ISIS operatives in the vicinity of Raqqa to guide the plotters every step of the way and significantly enhance their capabilities. While the TATP suicide vests used by the stadium attackers in Paris on November 13 produced only small explosions killing one person, the Brussels TATP suitcase bombs were much more powerful and killed 32.
Forensic recovery
When Belgian computer technicians first examined the laptop, they faced several obstacles.
The first and most frustrating was that much of the contents of the hard drive had been permanently deleted by the terrorists. The second was that the cell had at times made use of a widely commercially available full disk encryption software program while working on the computer. The third was that the terrorists had used software to make themselves anonymous and to wipe away Internet traffic.
Undaunted, the digital investigators used forensic software tools to unlock as much information as they could from the laptop. This allowed them to retrieve the names of deleted files, the time they were most recently opened and time they were burned onto the hard drive, providing critical metadata on the cell’s attack plotting. Though much of the content lay out of reach, the computer technicians were also able to fully recover a significant number of deleted files, as well as retrieve several audio files.
Their analysis revealed the computer was first used by the terrorist cell on October 9, 2015 — more than a month before the Paris attacks, with the last entry the day before the Brussels attacks. Although the computer belonged to Laachraoui, Mohamed Abrini — the so-called “man in the hat” at Brussels airport — told investigators several members of the cell used it, according to the police document. (A last will and testament allegedly written by Abrini in early 2016 was also found on the laptop in which he revealed he had traveled to Syria. He has been charged in connection with the attacks and is awaiting trial).
Examining WiFi connections, investigators also ascertained the laptop had been used at several of the safe houses used by the cell in Belgium, including a different apartment used to make bombs for the Paris attacks.
The November 13 file
The investigators found a prodigious amount of terrorist propaganda on the laptop, including tapes by Osama bin Laden and the American-Yemeni cleric Anwar al Awlaki. The contents of some of the recovered files showed the plotters were interested in surveillance and counter-surveillance, weapons, document falsification and explosives.
A file labeled “study” caught investigators’ attention because it showed the cell had been interested in nuclear facilities and alerts. As CNN has previously reported, investigations by then had revealed individuals linked to the terrorist cell had conducted video surveillance of a Belgian nuclear official.
But what most piqued the interest of investigators was the metadata retrieved from files whose contents had been permanently deleted from the computer. One of the files was titled “13Novembre” while another was titled “Targets” and a third was titled with the Arabic word for explosives and appears to have contained information on TATP, the homemade explosive triacetone triperoxide, which has been used in terrorist attacks.
The file titled “13Novembre” was accessed between November 7 and November 11, 2015, revealing the attack date had by then been selected and divisions of labor clinically allocated.
Further investigation showed the November 13 file contained several subfiles with the following path names:
Groupe Omar; Groupe Francais; Groupe iraquiens; Groupe métro; Groupe Schiphol
While the contents of these files, including deleted pictures that may have shown the targets, were not retrievable, investigators quickly concluded that:
• Groupe Omar likely referred to the Paris cafe attack team led by Abdelhamid Abaaoud (also known as Abu Omar)
• Groupe Francais likely referred to the three French ISIS operatives tasked with attacking the Bataclan music hall. (A file accessed on the computer on November 7, 2015, was named 13Novembre/Images/bataclan.jpg).
• Groupe iraquiens likely referred to the three-man Stade de France suicide attack team which included two fighters later identified by ISIS as Iraqis.
Investigators are still not sure what the “Groupe métro” referred to. While several of the Paris plotters traveled by metro the night of the attacks, there were no attacks underground.
The reference to Schiphol international airport in Amsterdam at first puzzled investigators. Was this a target the cell aimed to hit simultaneously or an escape route for some members of the cell? But as CNN first reported last September investigators now believe the cell was probably tasked with hitting the Netherlands as part of an initial wave of attacks.
Investigations revealed two members of the ISIS terror cell stationed in Belgium traveled by bus to Amsterdam on November 13, 2015, according to Le Monde. It is still unclear why they did not carry out an attack.
The file named “Targets” had several subfiles including ones titled “Civitas” and “Défense.” Belgian investigators believe the latter refers to the La Défense shopping quarter in Paris, which Abdelhamid Abaaoud was planning to strike at the time he was killed by French commandos following the Paris attacks. Belgian investigators believe Civitas refers to a conservative French Catholic association. French media have previously disclosed it was a potential target.
Audio briefings
Among the most interesting material retrieved from the laptop were seven audio files, some of which had been moved to — but not permanently erased from — the computer’s recycle bin.
Two of these contained in essence audio briefings on the terrorist cell’s progress recorded by Laachraoui for Abu Ahmad, a senior member of ISIS external operations division in Syria. The voice of Ibrahim el Bakraoui, one of the Brussels airport suicide bombers, is also occasionally heard.
Abu Ahmad, who is still at large, was subsequently identified as el-Bakraoui’s cousin Oussama Atar, a veteran Belgian-Moroccan ISIS operative who cut his jihadi teeth fighting American forces in Iraq a decade ago.
In an audio briefing for Abu Ahmad recorded sometime between February 15 and March 15, 2016, Laachraoui asked an ISIS bombmaker named “Mahmoud” a series of technical questions relating to making TATP, suggesting he was possibly trying to improve on the recipe he used in the Paris attacks.
At one point in the briefing, Laachraoui alluded to an ISIS sleeper cell in France. He asked Abu Ahmad if the cell was still operational and whether he could provide it with bomb-making tips.
He told his ISIS handler that he and others preferred to “hit” France rather than Belgium because he felt it was better to keep Belgium as a “fallback base” for “brothers” carrying out attacks.
In the same tape, Laachraoui briefed Abu Ahmad on an idea he had come up with Ibrahim and Khalid el-Bakraoui (the Brussels metro bomber) to take hostages to free Mehdi Nemmouche, who is in jail, awaiting trial for killing four people at a Jewish museum in Brussels in 2014, and Mohamed Bakkali, a Belgian charged in connection with the Paris attacks.
An audio recording by Ibrahim el-Bakraoui found on the laptop showed that by his own account he pledged allegiance to ISIS in November 2014, and “had the honor of getting to know” ISIS fighters, suggesting, according to the Belgian investigative file, that he and his brother may have managed to slip into Syria. It was not previously clear whether either el-Bakraoui had reached Syria. After the Brussels attacks, Turkish officials said Ibrahim el-Bakraoui was detained in Turkey in July 2015 and deported to the Netherlands.
Why the cell attacked Brussels
The second and last audio briefing for Abu Ahmad was recorded by Laachraoui and Ibrahim Bakraoui the day before the Brussels attacks. The duo complained to their superior about the fact that several of the cell who had been surprised by Belgian police in a safe house in Forest on March 15, including Salah Abdeslam, had chosen not to use the weapons in the flat and flee rather than fight to the death. They praised Mohamed Belkaid, a senior Algerian member of the cell, for standing his ground and engaging police with a Kalashnikov before being shot dead.
With the dragnet coming down around them, they explained to Abu Ahmad they were going to launch an attack before they were caught and were sending him their last wills and testaments.
“The situation is such that we cannot delay in any respect you see. We have to work as quickly as possible and we have decided to work Insha’allah tomorrow, Tuesday 22 March … Insha’allah. During the morning … because we no longer have secure safe houses, and there’s no one left etc. You see there are no longer any brothers left for logistics etc. And everybody is burnt you see … All the photos [of us] have come out etc,” the terrorists in Belgium are heard saying on the recording.
It is not clear whether Abu Ahmad ever replied.
