Paris Attacks, November 2015 - Assessment

© ISS Risk 2015 Page | 0

Paris Attacks: Updated Assessment (Updated as of 3 December, 2015)

Intelligent Security Solutions Limited

www.issrisk.com

http://www.issrisk.com/


Overview

The ability for ISIS to effectively deliver its agenda of terror and to affect an ever evolving

threat on an incrreasingly global scale has been clearly demonstrated through the Paris

attacks of November 2015. Intelligent Security Solutions (ISS Risk) has for some time

focused on the threat presented by ISIS (and other Islamic extremist groups) to various

sovereign and commercial concerns across Eurasia, with a specific focus on not only ISIS‟

motivations and actions to date, but more importantly a focus on how the threat is being

shaped and how it will be driven and manifested in the coming 12-18 months.

As detailed in this report, and in several other engagements for a growing number of clients

in Asia and Europe, ISS Risk has looked to present clients with the benefits of our threat

trajectory assessments at local, provincial, sovereign and transnational levels. Indeed, owing

to our proven ability to make the correct initial assessment through the effective

extrapolation or interpolation of trends in ISIS activities, we are uniquely positioned to see

what are the „new denominators‟ to their activities and therein recognise factors rightly as

fixed not emergent or irrelevant. As shown with the Paris attacks the absence of coherent

and rooted answers to core security questions, such as how did they perform such a

complex attack? why and how was this achieved? will they strike again? how under-

prepared are the security services in Europe? is this the beginning of an orchestrated

campaign? etc… have been as near shocking as the events themselves.

For ISS Risk the critical deliverable is to ensure the specific needs of our client are serviced

effectively and in full. Given the very high security walls around what is being found in the

trans-national investigations so far, both our aforementioned existing knowledge of ISIS‟

modus operandi and most current driving forces to its actions, and our connections within

the intelligence communities in Europe have proven seminal.

This report examines the answers to the critical questions of what is known about the

attackers and the terrorist cell so far? How did the terrorists enter Europe, and move

undetected? What do the combat indicators from the Paris attack reveal of ISIS‟ wider

intentions towards high profile cities in Europe going into Christmas 2015 and in 2016? How

will further escalation most probably manifest itself, and are attacks of such size likely again?

Who will perpetrate these attacks, and how effectively can security services respond to

contain threats from ISIS‟ existing operatives and cells already in Europe?

Intelligent Security Solutions Limited Frontier & Emerging Markets Analysis


Paris Attacks: Updated Assessment

The world was shocked by a series of bombings, suicide explosions and shootings which

took place in Paris overnight on 13-14 November, killing 132 people and injuring more than

300 others. It was a meticulously planned and coordinated attack on 8 targets involving at

least 9 attackers targeting the Bataclan Concert Hall during a rock concert, the Stade de

France during an international soccer game and 5 different bars and restaurants in central

Paris.

A total of 89 people were killed in the concert hall, one was killed near the stadium and the

remaining victims were killed during attacks on the bars and restaurants. Six of the attackers

died by exploding their suicide vests, the seventh shot by the security services, with the

remaining two perpetrators remaining at large as at the time of the release of this report. The

security forces were able to bring the situation in Paris under control at around 12.20 AM

(local time) on 14 November. The terrorist group Islamic State in Iraq and Syria (ISIS) later

claimed responsibility for the attack as retaliation against French airstrikes in Syria and Iraq,

and for the French policies against Muslims worldwide.

On 18 November, French security forces launched a major security operation at an

apartment in St-Denis, north of Paris city centre, targeting Abdelhamid Abaaoud, the

suspected mastermind of the 13 November attacks. Three people were killed in the raid –

including Abaaoud and his cousin Hasna Aiboulachen.

Second round of attacks were imminent

Immediately following the St-Denis raid, investigators revealed that the killed terrorists were

in the final stage of preparing and carrying out „imminent‟ attacks at Charles de Gaulle

airport and the Quatre Temps shopping centre in La Defense, west of Paris. A few days

later, confidential statements from witnesses of the Paris attacks were leaked to the French

media, which indicated that Abaaoud had approached his cousin Hasna asking her to hide

him while he prepared for further attacks. Abaaoud had reportedly told Hasna that he had

planned imminent attacks that would do far greater damages in Jewish majority districts of

Paris, as well as against public transport systems and schools. Abaaoud also boasted how

he slipped into Europe with Syrian refugees and remained undetected prior to the 13

November attacks.

Timeline of attacks

The attacks were carried out by three teams, with each team comprising of three members.

We have colour coded the different teams in three colours – green, pink and red and plotted



their targets and timeline of attacks in the map below. As evident from the map, the green

and pink teams initiated their attacks almost simultaneously, while the red team commenced

their operation 29 minutes after the first incident was reported. The attacks were planned

and coordinated to create multiple pockets of chaos within the target geography, so as to

overwhelm the security forces and maximise civilian casualties.

From the perspective of the terrorists and as later demonstrated from the number of

fatalities, the Bataclan Concert Hall was the prized catch – a location where they were

expecting to find a large number of unarmed civilians cramped in a confined space with

limited exit options. In other words, the maximum number of people could be killed in that

concert hall target. It is our assessment that the green and pink attacks were diversions,

aimed at providing sufficient time to the red team to attain vantage points inside the concert

hall and to kill as many people as possible before the security forces arrived. In line with this

logic, it is most likely that the three most competent operatives from the nine attackers were

selected to carry out the attacks in Bataclan.

What is known about the attackers and the cell so far?

The identities of the following attackers/conspirators have been identified so far:

1. Ibrahim Abdeslam – suicide bomber: Ibrahim Abdeslam was a suicide bomber who

blew himself up outside the Comptoir Voltaire restaurant in Paris. He rented one of the

principal operational vehicles of the terrorist cell, a Seat Leon car, which was found

abandoned in a Paris suburb with Kalashnikov rifles inside. He was a Belgian national, a

former resident of the Molenbeek district of Brussels, who had spent time in Syria.



Investigations have revealed he had possible links with the Verviers terrorist cell in

Belgium, which was destroyed by police raids in January 2015.

2. Salah Abdeslam – on the run: An international arrest warrant has been issued for

Salah Abdeslam - a Belgian national who rented a black VW Polo in Belgium which was

found abandoned near the Bataclan concert hall. He is the brother of Ibrahim Abdeslam

and is also suspected of having spent time in Syria. He was stopped near the Belgian

border on 14 November morning in a grey VW golf also carrying two suspected

accomplices, but was not arrested at that time.

3. Omar Ismail Mostefai – suicide bomber: Aged 29, was one of the three men who

blew himself up in the Bataclan concert hall. He was a French national of Algerian

origins and had trained with ISIS in Syria in 2014.

4. Bilal Hadfi – suicide bomber: Hadfi blew himself up outside gate H of the Stade de

France. He was a French national, who lived in Belgian and is believed to have fought

with ISIS in Syria.

5. Ahmad al Mohammad – suicide bomber: A Syrian passport holder, he died in the

suicide attack near the Stade de France.

6. Sami Aminour – suicide bomber: A French national who blew himself up at the

Bataclan concert hall. He was charged in a 2012 terrorism investigation by the French

authorities and was placed under judicial supervision. Authorities lost track of him, and

following the discovery that he had travelled to Syria, an international arrest warrant was

issued against him.

7. Abdelhamid Abaaoud – attack mastermind: A Belgian national, he is believed to be

the mastermind of the Paris attacks. He joined ISIS in Syria and was an active member

in its propaganda division. Abaaoud was also involved in the planning of the Thalys train

attack in France in August 2015.

8. Hasna Aiboulachen – female terrorist: A French national of Moroccan origins and the

cousin of Abdelhamid Abaaoud. She died during the St-Denis police raid.

9. Four unidentified terrorist – three dead, one remains a fugitive: The identity of four

terrorists remains uncertain. Two of them were killed during the Paris attacks and one

was killed during the St-Denis police raid. The fourth one is believed to have participated

in the Paris attacks and has since evaded arrest. Unconfirmed comments from an

anonymous French senator suggest that two of these unidentified terrorists had fake

Turkish passports.

10. Hamza Attou – suspected accomplice: A Belgian national aged 21, he was one of the

two individuals who exfiltrated Salah Abdeslam from Paris following the attacks, driving

him to Brussels. Police found ammonium nitrate – a fertiliser that can be used to make



bombs – and assault rifle ammunitions at his residence. He has been arrested on

charges of terrorist murder and conspiracy.

11. Mohammed Amri – suspected accomplice: A Belgian national aged 27 who

accompanied Hamza Attou in driving the escape vehicle from Paris post-attacks for

Salah Abdeslam. He has since been arrested and police have reportedly found bomb

making materials at his residence in Brussels.

12. Ali Oulkadi – suspected accomplice: A French national, aged 31 lived in Molenbeek.

He drove Salah Abdeslam through Brussels a day after the Paris attacks. He has since

been arrested on charges of terrorism.

13. Abraimi Lazez – suspected accomplice: A Belgian national of Moroccan origin, he

also drove Salah Abdeslam in Brussels after the Paris attacks. He has been arrested by

Belgian authorities with police recovering two handguns and forensics identifying traces

of blood from his vehicle. Abraimi‟s brother is known to be currently in Syria.

14. Mohammed Abrini – suspected accomplice – remains a fugitive: He was seen with

Salah Abdeslam on a highway to Paris two days before the Paris attacks. Abrini was

driving a Renault Clio car which was later used by the attackers. He currently remains a

fugitive at large, with a Belgian court having issued an international warrant for his

arrest.

15. Jawad Bendaoud – suspected accomplice: A French national, identified as having

rented his apartment in St-Denis to Abdelhamid Abaaoud, where the Police raid took

place on 18 November. He is the first person from Paris who has been charged with

helping the Paris attackers. Bendaoud is himself a convicted killer and notorious

gangland leader, having served jail sentences, with 13 criminal convictions alone since

2010.

16. Mohammed K – bomb maker – remains a fugitive: Belgian police have issued a

search warrant for an individual named Mohammed K, who is believed to be the bomb

maker who prepared the suicide vests used in the Paris attacks. He is originally from the

Caribbean, has lived in Roubaix in northern France and is currently believed to be in

Belgium.

17. Unnamed man from Brussels – suspected accomplice: The Belgian authorities on

27 November arrested a man from Brussels on charges of involvement in the Paris

attacks. No details have been made available yet about the identity of the suspect.

18. Unnamed man from Germany – suspected accomplice: The German authorities

have arrested a man for selling assault rifles to the Paris attackers. No further details

are available.

19. Additionally, a few other people have been arrested in Belgium, although there are no

confirmed details about their identity or possible involvement in the Paris attacks.



Thus far, 10 terrorists have been killed, 4 suspects remain fugitives and another 9-10 have

been arrested – bringing a total of 23-24 people identified by authorities as being involved in

the Paris attacks. Of the 15 people identified so far, seven are French nationals, another

seven are from Belgium, one from Germany and one supposedly a Syrian national (although

conflicting reports are emerging that he might have used a stolen identity). All 15 people of

these persons have been identified as being Muslims of Middle-Eastern or North African

origins. Importantly here, at least seven of the identified individuals had been to Syria in the

recent past. Additionally, a small number of people have been arrested in Turkey following

them being identified as having exchanged messages with the Paris attackers. Thus, the

total number of perpetrators involved in the attacks is likely to be above 25 – at least for the

time being and has the potential to grow as the ongoing investigations reveal more people

involved in the attacks. This specific is in contravention to the initial estimates given by the

Belgian authorities that a cell of 20 people was involved in the Paris attacks. The growing

number of suspects involved in the attacks in fact conforms with our initial assessment

(dated 22 November, 2015) that a complex, well-coordinated and simultaneous attack of

such a scale would realistically require much higher manpower to properly plan and execute.

These points are discussed later in this report.



How did the terrorists enter Europe?

As mentioned above, at least seven of the suspects involved in the Paris attacks were

veterans from the war in Syria. It is our assessment that the three unidentified attackers also

needed military training to execute the attacks in the way they did, something which they

would have most probably undertaken in Syria. So, in total, at least 10 individuals travelled

from Syria to France via Europe without detection.

As mentioned in a later section of this report, we believe that the group entered Europe in

the very recent past, somewhere between late September and early October of this year.

Although, very little information has thus far been made available on how these suspects

entered Europe, we have been able to piece together the possible routes taken by five of

these attackers.

1. Sami Aminour: French authorities believe he entered Europe via Greece. He was in

the Fiche-S or S-Card watch-list of the French authorities and is most likely to have not

used his French passport to gain entry into the Schengen Zone. The only other option is

thus to gain entry as a refugee, as demonstrated by Aminour entering Europe via

Greece.

2. Salah Abdeslam: He entered Europe via Greece using his own Belgian passport. He

was spotted at the Austrian border on 9 September, where he mentioned he was on a

one-week vacation in Austria.

3. Bilal Hadfi: An international arrest warrant was issued against him by the Belgian

authorities early in the year and he is believed to have entered Europe disguised as a

migrant.

4. Ahmad al Mohammad: Holding a Syrian passport (although he might have been using

a stolen identity) al Mohammad was rescued by authorities after the boat he was

travelling from Syria wrecked off the coast of Greece. Ferry tickets revealed that he

travelled to Europe with another individual named Mohammad al Mohammed and he

used his passport to buy tickets from the island of Leros to the Greek mainland. He then

joined a convoy of refugees and claimed asylum in Serbia, before travelling to Paris.

5. Abdelhamid Abaaoud: The mastermind of the Paris attacks also reportedly entered

Europe via Greece, posing as a Syrian refugee. This seems quite plausible as Abaaoud

was already a most-wanted man in Europe given his already documented involvement

and position within ISIS in Syria. As mentioned later in this report, Abaaoud even faked

his own death to facilitate his entry into Europe as a refugee.



How did the weapons reach France?

Automatic assault rifles such as Kalashnikovs were used by the perpetrators during the Paris

attacks. Given the fact that acquiring weapons in France is an extremely regulated process,

where an individual is required to undergo psychological examinations and identity

verification before he/she can obtain a license for the weapon, it becomes important to

understand how the Paris attackers were able to source these military grade weapons.

German police have recently arrested a man from Magstadt (Baden-Wurttemberg state) for

running an illegal arms business and selling guns over the so-called „dark web‟ section of the

internet, where he had his own trading platform named „DW Guns‟. Dark web is a part of the

internet that is not indexed by search engines, therein will not be found through any Google

search and is accessible only with specialised software installed by users. Investigations

revealed that this suspect, identified as Sascha W, had sold two Chinese made

Kalashnikovs and two Serbian Zasatava assault rifles to an „Arab in Paris‟ on 7 November.

Reports indicate that a few M70 assault rifles made by Zastava were indeed used by the

Paris attackers and Milojko Brzakovic, director of the Zastava Arms factory, has confirmed

that the serial numbers of those weapons indicated were indeed manufactured in Serbia

(Yugoslavia) in the late 1980s. Additionally, security raids in Brussels have also recovered a

large collection of firearms from the residence of one suspect.

It is our assessment that the German dark web arms dealer was only one of the several

sources used by the Paris attackers to procure their weapons. It is most likely that they

would have bought weapons in small consignments, from multiple sources, so as not to raise

any unwanted suspicion. Some of the weapons were also reportedly procured from the

Brussels underworld.

French investigators are also looking at the possible importation of deactivated assault rifles

from Slovakia. A deactivated weapon is a firearm which was originally produced as a fully

operational weapon, but has been subsequently deactivated mechanically so that it can no

longer discharge any ammunition. The deactivation process is intended to be permanent and

irreversible. However, according to experts, due to specific deactivation techniques used in

Slovakia, reversing the process is considered to be very easy for a person with the right

skills. Additionally, the Slovakian neutralisation process fails to affect the firing rate of the

weapon. Consequently, any illegal conversion will reconvert any deactivated Slovakian

weapon to its fully operational state and capabilities. Additionally, it is very easy to purchase

deactivated weapons in Slovakia, even the heaviest machine guns – any person with a valid



ID can purchase them. Perpetrators of the Charlie Hebdo attacks in January 2015 had also

legally purchased deactivated weapons from a Slovakian shop.

Additionally, it has now emerged that in October 2014 Salah Abdeslam had bought

approximately a dozen electric detonators from a pyrotechnic wholesaler north of Paris.

During the purchase, Salah was reportedly curious about the reliability of the devices. In the

likely scenario that the same detonators were used for the suicide vests in the Paris attacks,

it leaves open the possibility that the plan for executing a Paris like attack was made more

than a year ago. Unless Salah bought those detonators to carry out a lone-wolf attack -

which seems highly unlikely as he did not participate in any combat role during the Paris

attacks - he had purchased those detonators under instructions from ISIS high command.

This in turn would logically infer that ISIS leadership had committed command decisions and

assets to carrying out attacks outside Syria and Iraq at least before October 2014.

It is our assessment that ISIS leadership took this command decision to perform attacks

„abroad‟ in the wake of Western airstrikes, including those made by the French Air Force,

against ISIS targets in Iraq and Syria beginning in August 2014. ISIS‟ decision, simply put,

reflects the fact that they wanted to develop the capabilities to strike any country which was

waging war against them.

Molenbeek Cell

We shall identify the terrorist cell as the „Molenbeek Cell‟ as the mastermind of the cell,

Abdelhamid Abaaoud, was based in and planned the Paris attacks from the Molenbeek

district in Brussels. Moreover, several of the terrorists were also based in Molenbeek from

where they travelled to Paris to carry out the attacks. While Belgian intelligence officials have

claimed that 20 people were involved in the cell, as per our initial assessment we firmly

believe that attacks of such complexity in nature required greater manpower than 20. As the

investigations progress a number of points continue to support ISS Risk‟s initial

assessments and continued position.

Firstly, the Molenbeek Cell had planned to carry out two sets of attacks – the first one

undertaken on 13 November, the second thwarted through the St-Denis police raid. As

mentioned earlier, a total of 8 locations were targeted in the first phase of the attacks with a

further 2-3 reportedly planned for in the second phase – bringing the total to roughly 10

planned targets. While some of these targets were modest sized restaurants and bars, the

remaining 5 were very large targets – a large shopping mall, a famous concert hall, the

largest soccer stadium in France and the nation‟s most important airport.



Terrorist cells planning to carry out simultaneous coordinated attacks in major urban centres

need different teams of people to carry out a successful attack, with specific respective

duties – target location scout, surveillance, logistics, bomb-maker and the actual attackers.

Historically, these different responsibilities have been carried out by different members of the

cell, with the attackers usually not involved in any of the other activities and the bomb-

makers (considered too valuable to lose) usually not taking part in the actual attacks. To

illustrate this very point, in the 2008 Mumbai attacks, while 10 terrorists were involved in the

actual attacks, another 20 individuals were involved in support activities involved with the

execution of the attacks.

Returning back to the Molenbeek Cell, thus far, 9 attackers have been killed (including the

mastermind Abaaoud), and 2 remain as fugitives. Out of these, 9 were involved in the first

phase of the attacks and the remaining 2 were likely to be involved in / perform the second

phase, which involved attacking Charles de Gaulle airport, the Quatre Temps shopping mall

in Paris as well as a few other unidentified targets.

It is our assessment that there was no chance that only two people would have been

involved in this imminent second phase of attacks, as described by the French authorities. If

the cell was willing to dedicate 9-10 assets for the first phase, it would have required at least

another 10-15 actual attackers‟ for the second phase, particularly when one of the planned

targets was one of the busiest and most secure airports in the world. For example, the 2014

Karachi International Airport attack involved a group of 10 highly trained and armed

attackers.

As per our initial assessment (dated 22 November 2015) where we estimated that potentially

20-25 actual attackers would have been involved in the terrorist cell given the scale of the

planned and executed attacks, this should bring the total number of support personnel to

anywhere between 40 and 50. Therefore in all likelihood, the Molenbeek Cell would have

had an actual strength of anywhere between 60 to 75 personnel. Investigations thus far have

been able to identify around 30 people from different European nations as being involved

with the cell. Given that the investigation is still in its early stage, we believe that an

additional number of accomplices are likely to be identified and / or arrested in the coming

days. Therefore, we continue to hold to our original assessment that between 60 to 75

people were involved with the Molenbeek Cell. What is most worrying is that approximately

10 to 15 of those potentially unaccounted for individuals are extremely motivated, most

probably trained in Syria, have direct contact with ISIS leadership in Syria and hence remain

extremely dangerous.



Major escalation of ISIS modus operandi

Since the Paris attacks, several international media outlets are reporting on the emergence

of ISIS‟ external operations unit. Even the CIA‟s Director stated on 16 November that ISIS

had developed an external operations agenda, plotting attacks far outside its havens in Iraq

and Syria. However, such units do not become operational overnight; rather they require

significant gestation periods to setup overseas units, mobilise assets, plan and execute

attacks. In fact, as early as January 2015, reports had emerged that ISIS had formed the

„Anwar al-Awlaki Batallion‟ (AAB), a unit composed solely of English speaking foreign

fighters whose purpose was to plan and execute attacks in western nations. At the same

time, ISIS also formed a unit named „Katibah Nusantara Lid Daulah Islamiyah‟ (KNLDI),

which consists of Southeast Asian foreign fighters with the intention of spreading terror in

Southeast Asia. So, it is clearly evident that ISIS had been planning to expand its activities

outside MENA for well over a year now. In the context of the Paris attacks, as described

below, AAB becomes a very important unit.

On 27 September 2015, French jets carried out air strikes on an ISIS training camp in Syria,

which the French President Francois Hollande described as a “threat to our country”. While

no information was provided as to how that camp was a national security threat to France,

further investigation into the air strikes have revealed that the camp was most probably one

of several locations where foreign fighters recruited by the AAB were being trained for future

operations inside the European Union - in particular France and the UK. Consequently, in

light of such specific targeting, although the situation in Paris is being labelled as a failing on

the part of the intelligence services, this may only apply to the domestic intelligence

agencies and raises significant concerns about coordination and intelligence sharing

protocols. That is something that can be addressed, but time is off the essence.

According to Kurdish intelligence officials, ISIS had sent 20 specially trained foreign fighters

of the AAB to Europe in September 2015 mixed with the refugees. This particular batch

consisted of jihadis of Tunisian and Moroccan origins and was reported to have received

special training in IED and terrorist tactics, techniques and procedures (TTP)

implementation. These personnel were advised to return to their countries of origin and

establish attack cells.

What makes this group very important is that Abdelhamid Abaaoud was the leader of

that group. Abaaoud faked his own death in late September 2015, most probably to ease

his re-entry into Europe via Greece. As mentioned in the earlier section of this report, we had

identified at least ten Syrian war veterans as being involved in the Paris attacks. We also



identified that at least five of them had entered Europe via Greece. Immediately after the

Paris attacks, French intelligence agencies were able to identify Abaaoud as having played a

pivotal role in coordinating the movement of the attackers and by linking them with the local

cell in Europe. It is worthwhile noting that throughout this time he was still presumed to be

dead for over a month following an airstrike in Syria. Survivors of the Paris attacks later

claimed that the attackers were all of Middle-Eastern appearance yet spoke perfect French

without accent, fitting perfectly with AAB‟s stated objective of sending native language

speakers to Europe as well as the Moroccan and Tunisian origins of the group of 20 people

we discussed earlier.

While, 10 people from this group of 20 specially trained AAB fighters were found to be

directly involved with the Paris attacks, it is our assessment that the other 10 remain in

Western Europe, most probably in Belgium or France – or were at least until 18 November

(the day of the St-Denis raid). We believe these individuals were scheduled to attack Charles

de Gaulle Airport and the Quatre Temps shopping centre in Paris in the second phase of the

attacks planned by Abdelhamid Abaaoud and which were only prevented by the St-Denis

raid. Additionally, this unaccounted for group of 10 Syria veterans fits in with our initial

assessment that additional manpower was required to execute the second stage of the

attacks.

Many media reports are claiming that Abaaoud was close to ISIS‟ leader Abu Bakr al-

Baghdadi. However, there is no verifiable information in that regard. What we know for

certain is that Abdelhamid Abaaoud was the right-hand man of ISIS‟ spokesman and

external operations unit chief Abu Muhammad al-Adnani. Abaaoud was actively involved in

training foreign fighters in camps inside Syria and also was a „star-campaigner‟ in recruiting

fighters from Europe. He was featured in the ISIS propaganda magazine Dabiq on a regular

basis and had travelled to several European countries during the last year.

Abaooud has been identified as trying to execute attacks in France since at least the

beginning of 2015, and has held links to the perpetrators of the Charlie Hebdo attacks. A

jihadist arrested in August 2015 in France confessed that he was also trained and motivated

by Abaaoud to carry out attacks in French soil. Additionally, Abaaoud also had links with the

perpetrator of the failed Thalys train attack in August 2015.

Chronology of Jihadi attacks that took place in France during in the last year:

1. December 2014: Knife attack against Police Officers; Tours. Lone wolf attack carried out

by self-radicalised individual.



2. December 2014: Vehicular attack, 11 pedestrians attacked; Dijon. Lone wolf attack

carried out by self-radicalised individual.

3. December 2014: Vehicular attack, 10 pedestrians attacked; Nantes. Lone wolf attack

carried out by self-radicalised individual.

4. January 2015: Charlie Hebdo attack and multiple shootings; Ile-de-France region. Cell

based attack with foreign training.

5. April 2015: Unsuccessful attack against 2 churches in Villejuif; Ile-de-France region.

Lone-wolf attack carried out by individual motivated by ISIS handler Abaaoud.

6. June 2015: Killing (decapitation) and attempted explosion by perpetrator; Lyon. Lone-wolf

attack, perpetrator had links with ISIS.

7. August 2015: Attempted mass-shooting on an Amsterdam-Paris train; Paris. Lone-wolf

attack carried out by individual trained in Syria and was handled by Abaaoud.

8. November 2015: Series of suicide bombings and multiple shootings; Paris. Cell-based

well-coordinated multiple attacks carried out by personnel trained in Syria by ISIS.

In reviewing the nature of these attacks there are clear indications that ISIS has slowly

shifted from a strategy of supporting lone-wolf attacks by self-radicalised individuals, to lone-

wolf attacks directly motivated and trained by ISIS to (finally) well-coordinated cell-based

attacks across multiple targets. This is a clear evolution and indeed major escalation of the

ISIS‟ modus operandi, clearly indicating that ISIS now has the capability to execute attacks

in western nations while authorising the same from Syria.

We believe that we will continue to see „lone wolves‟ being inspired to carry out attacks, but

now the paradigm has shifted to where we are going to begin seeing more from veteran

terrorists who have returned from Syria and who are charged with (re-)forming cells made up

of fellow combat veterans they fought with in Syria. The transition from lone-wolf to cell-

based attacks is a major achievement for ISIS and demonstrates their abilities way beyond

their strongholds in Iraq, Libya and Syria. In fact, in parallel with the significant attacks in

Paris, the twin suicide bombing in Beirut on 12 November were a further example of how

ISIS‟ capabilities in executing major attacks outside its strongholds have developed.

The relevance of the combat indicators from Paris and the unfolding situation

in Molenbeek and Belgium

Molenbeek district in Brussels has attained much notoriety after several perpetrators of the

Paris attacks were found to have lived in this district, with the international media describing

it as the „jihadi capital of Europe‟. Two days after the Paris attacks, Belgian Interior Minister

Jan Jambon said that the situation in Molenbeek was not under control and the authorities



would have to step up efforts there as the next task. But this was not the first time that

Molenbeek has been linked with jihadis. From the pre-9/11 assassination of anti-Taliban

commander Ahmed Shah Massoud, to the Madrid train bombings in 2004, to the killings in

the Brussels Jewish museum in 2014 and the foiled shooting attempt in a Paris bound high-

speed train in August 2015, the investigations for each of these incidents have commonly led

to Molenbeek.

Finding the reasons for this are fairly academic at this moment; simply put forward, the

district has proven a very fertile ground for the recruitment of Islamic extremists. According

to Flemish researcher and expert on Belgian jihadism, Pieter Van Ostaeyen, in October

2015 there were approximately 190 Belgian fighters in Syria, mainly with ISIS, with a further

120 Belgian fighters having returned back to Belgium from the war. Statistically speaking,

Belgium, with a Muslim population of circa 640,000, suffers roughly 1 jihadi being involved in

Syria or Iraq for every 1,260 of its Muslim nationals. On a per capita basis, this makes

Belgium the top European nation in terms of contributing foreign fighters to the Syrian war.

According to Van Ostaeyen, of the 190 Belgians in Syria, 101 were from Brussels and

Molenbeek would have supplied a significant number of them.

A significant weapons cache was discovered in Molenbeek in the wake of the security

operation there on 18 November. Brussels was under security lockdown for four days

because of a „serious and imminent threat‟, during which schools and public transport

systems were shut down. Several police raids were conducted in Brussels and southern

Belgium, while a manhunt was undertaken to apprehend Salah Abdeslam and other

accomplices of the Paris attacks. At least 16 suspects were arrested during the raids,

although many of those arrested were released later. Brussels still remains at the second

highest possible security alert level.

The threat of further cells is clearly spurring these developments - and rightly so. If

assessments and intelligence are close to being accurate regarding the training of external

resources in Syria and subsequent deployment to Europe, then essentially only one cell has

been potentially neutralised. That leaves a potentially large and significant pool of

commanders and / or coordinators having been deployed to predetermined and selected

targets who can initiate attacks at will in their designated region of operations. They hold the

strategic advantage at the moment and will seek to maintain the momentum. The increasing

sophistication of these domestic attacks is a genuine concern - as we discussed above the

strategy is evolving from singular lone wolf domestic attacks to well-coordinated attacks.

The potential number of attacks is the discerning aspect of this; we live in extremely target

rich environments, the security services cannot be everywhere at all times. The likelihood of



a diverging strategy of launching attacks on principal targets and cities then switching to

smaller cities or towns, transportation hubs and back again to major targets will become the

reality unfortunately. We will move from this type of cellular structure in diagram A below to

diagram to B over time. It is in fact already in play.

Diagram A – Diametric example of localised Cell structure

Diagram B – Diametric example of transnational Cell structure



The strategy behind the ISIS escalation

The escalation in the ISIS strategy essentially became apparent to the world with the

downing of the Russian passenger plane over the Sinai desert, followed by the Beirut twin

suicide bombings in 2015. Then came the assault on Paris, and with the shock of Paris still

raw, came the Mali hotel attack – albeit claimed by an al-Qaeda off shoot (this attack differs

from the ISIS campaign in terms of motivations, along the lines of a „Jihadists Who‟s got

talent‟ play off), this attack requires analysis within the context of the broader Jihadist

campaign now savaging many regions. But, aside from the shock and awe of the scale of

the Paris attacks should we be surprised by these developments? The foresight and

strategic planning for this escalation did not merely happen in the past few months, or in the

midst of the refugee crisis. This has been a long thought out strategic escalation, and what

we are now seeing is just the beginning. The downing of the Russian plane was patently a

message to Russia, and a veritable poking of the hornets‟ nest for a predictable response.

Similarly Beirut was about escalating the internecine Shia and Sunni conflict and showing

capabilities. Paris was an unambiguous message to the world from ISIS that „we‟re going

global‟.

It is important to realise that every decision taken by ISIS is part of a larger strategy to

ensure the survival and expansion of their Caliphate. So if western political leaders claim

that the attacks were carried out because ISIS did not like the freedoms of the west or the

western way of life, then they are nothing but politically correct statements that fail to give

due importance to the realities behind these attacks.

The survival of ISIS as an organisation depends on the continuous support of its followers

across the world, and the flow of foreign fighters such support generates. To maintain that, it

needs to at least appear to be winning or gaining grounds in the battlefield. An ability to

strike in the centre of western „infidel‟ heartlands immediately raises the popularity of the

group in the eyes of its global followers and also makes it appear to be gaining momentum.

However, there is also a secondary and more sinister objective behind attacking these

locations.

Groups like ISIS survive by claiming that Islam is under attack and also by spreading hatred

between Muslims and non-Muslims. The ideology of global jihad is nothing but the belief in

the existence of a perpetual conflict between Muslims and non-Muslims, between two

mutually exclusive universes of cognition – a clash of civilisations so to speak. To propagate

that ideology, it becomes important that there be real or imaginary acts of atrocities



committed against Muslims by non-Muslims from time to time. It is the hatred that such

incidents generate which ISIS or its likes use as their biggest recruiting tool.

The latest reports indicate there has been a spike in Islamophobic incidents in France since

the Paris attacks, with mosques being vandalised and Muslims getting publicly humiliated for

their faith. A similar spike in hate crimes were evident following the Charlie Hebdo attacks in

January, with the first six months of 2015 witnessing a 284% increase in such incidents as

compared to the previous year.

Additionally, the attacks have and are also having an impact on the political discourse in

Europe and have emboldened the right-wing political parties to condemn Islam and vilify the

refugees entering Europe. From the UK Independence Party (UKIP) and Britain First, to

France‟s National Front and Germany‟s Pegida, right-wing groups across Europe have used

the Paris terror attacks to aid their anti-Islam, anti-immigration agendas. In doing so, several

groups have characterised recent events as an ongoing conflict between the West and

Islam.

France has declared a state of emergency for three months, which has already allowed for

more than 1,000 warrantless police searches, 165 warrantless arrests, and placement under

house arrest of more than 250 people. There are also calls of expelling radical imams from

the country, closing mosques suspected of preaching religious hatred and stripping French

citizenship to individuals engaged in anti-French activities. There have been serious calls for

the internment of the thousands of people listed by the intelligence services as possible

national security threats; French Prime Minister Manuel Valls has declared himself open to

the possibility. In Belgium, the authorities have announced security crackdown, with an

addition € 400 million to be spent on security, the conducting of night searches as well as the

banning, conviction or expulsion of „hate preachers‟.

This is precisely what ISIS wants to see happen. Such draconian responses from France in

particular and Europe in general will beget a fresh cohort of alienated, angry European

terrorists; at best, they will be propaganda fodder for ISIS's recruiters, who will present them

as further evidence of Europe‟s hypocrisy, its willingness to apply its fundamental values

variably, and its alleged oppression of Muslims. ISIS wants to provoke the West into what

they will call a crusade, so that they could count on growing support from marginalised

Muslims both in MENA and in European countries such as Britain and France and draw on

growing support bases further afield into Central Asia and Southeast Asia. Thus far the right

wing and reactionary politicians are giving them exactly what they desire.



Future plans of ISIS for Europe and further afield

Although ISIS will continue to export trained terrorists to Europe and mixing them with

refugees it is now a largely academic consideration, the horse has well and truly bolted on

this element of their planning. ISIS has been far ahead of the western security services on

this one. The network of commanders and trainers has long since been established, shutting

the borders although necessary to stem further infiltrations is reactionary and will only

mitigate enhancement of the threat in a limited fashion.

The western world is facing the very real and present danger of a downward spiral into

asymmetrical warfare from within. The question is where else has ISIS set their sights? What

other countries and regions have ISIS already been dispatching commanders and trainers

to? The world watched the Arab Spring unfold during the beginning of this decade; we are

now bearing witness to the birth of a globalised ISIS, the consequences of which will be with

us for a long time to come as the organisation‟s tentacles emerge in unexpected locations in

the coming months and years.

Further to this point, there are reports that IS has also invested heavily in Libya to establish

an official affiliate, which would serve as a launching pad for conducting facilitation

operations in support of other ISIS aligned entities throughout Sudan, Tunisia, Algeria,

Nigeria and Egypt. The Libyan ISIS Emir Abu Nabil is a senior member of the ISIS external

operations division and was dispatched to Libya to establish and lead the affiliate in-country.

One of his other principal assignments was to open up a second pathway from which attacks

against Europe could be conducted. Still, ISIS won't be abandoning the use of lone-wolves.

Instead, they'll likely opt to use a combination of lone-wolves and attack cells to „reach out

and touch‟ the West.

In the meantime, ISIS propaganda department will flood social media and law-enforcement

hotlines with false tips and threats to overwhelm western security forces and stretch their

resources. On 18 November, a soccer match between Germany and Netherlands was

cancelled due to a bomb threat. This came in the form of an ambulance that had what

appeared to be explosive material placed on-board. The German government would later

deny that the vehicle contained any explosive materials however, the ambulance did in fact

contain an explosive material albeit not wired to detonate. In other words, it was a very

effective hoax. We suspect actual explosives were used to trigger a response from bomb-

sniffing dogs. Other hoax incidents have seen a small number of flights diverted due to

threats being called in.



But Europe is not the only place where ISIS wishes to spread its tentacles; its objectives are

much more ambitious and ISIS wants nothing short of global domination. While in Europe,

ISIS‟ primary objective at the moment seems to be carrying out mass-casualty attacks; for

other Muslim majority parts of the world like South Asia and Southeast Asia, ISIS has long

been trying to setup local chapters of its caliphate by using its cadres from these respective

regions.

As mentioned earlier, the external operations unit of ISIS had formed the Anwar al-Awlaki

Batallion (AAB) in January 2015 for carrying out operations in Europe. At the same time, it

formed another sister unit of AAB, named „Katibah Nusantara Lid Daulah Islamiyah‟ (KNLDI)

or the „Malay Archipelago Unit of the Islamic State‟, consisting solely of Southeast Asian

foreign fighters in ISIS. The purpose behind KNLDI was to setup an organisational structure

for the mobilisation of Southeast Asian jihadis for the religious and military cause of ISIS –

one that would eventually establish a chapter of ISIS‟ caliphate in the region. KNLDI also

serves as a direct link between ISIS and several local or regional jihadist organisations in the

region who have either pledged allegiance or support ISIS. As recently as 26 November,

Indonesian security forces had a four-hour long gun battle with ISIS affiliate Ansar Khalifah

Philippines in Sultan Kudarat province of Philippines, during which 8 jihadists were killed.

Earlier on 19 November, an internal classified memo of the Malaysian Police forces was

leaked to the media which detailed 18 Syria trained ISIS suicide bombers as having entered

Malaysia, with 10 being present in Kuala Lumpur itself. The memo also mentioned that the

suicide bombers were awaiting instructions from their leaders to launch attacks.

In the case of Pakistan, there are confirmed reports that ISIS has established several

training camps in its Baluchistan province and has allied with several local and sectarian

terrorist organisations to establish its operational presence in the region. ISIS has also

declared jihad against the Afghan Taliban and has already carried out several attacks

against Taliban strongholds inside Afghanistan.

Even for a nation like Bangladesh, which despite being a Muslim majority nation had so far

largely stayed away from global jihadist activities; ISIS seems to be making significant

progress. It began in September 2015, when US officials informed Bangladeshi authorities

that ISIS linked jihadists were planning to ramp up activities inside the nation. In the days

that followed, a series of unusual attacks seemed to substantiate the warning. An Italian and

a Japanese national were shot dead within days, followed by a bombing inside a Shia

mosque and recently, on 26 November, gunmen opening fire inside another Shia mosque.

While all these incidents were unprecedented in Bangladesh; ISIS claimed responsibilities

for each of these attacks.



Was there an intelligence failure?

The European intelligence agencies had received several warnings prior to 13 November

that an attack on France was imminent. French authorities were aware in August 2015 that a

French jihadist who went to Syria was asked by ISIS to carry out an attack on a concert

venue in France. Similarly German authorities had detained an Algerian man from a refugee

centre in Arnsberg who was telling other Syrian refugees that an attack was imminent in the

French capital.

Most importantly, at least five of the individuals involved with the Paris attacks were known

to the French or Belgian authorities as potential/actual jihadist elements, with a few having

international arrest warrants against them.

In January 2015, Ibrahim Abdeslam was detained by Turkish authorities and deported back

to Belgium. Turkish authorities at that time mentioned that Ibrahim had been radicalised and

was waiting to join ISIS in Syria. But Belgian authorities later set him free. The same Ibrahim

later blew himself up at the Comptoir Voltaire bar in Paris on 13 November.

Ismail Omar Mostefai had been in the French S-list since 2010. Turkish police considered

him an ISIS member and had reportedly warned Paris about Mostefai twice – once in

December 2014 and later again in June 2015. There was no response from the French

authorities while Mostefai freely travelled between Europe and Syria. He later blew himself

up at the Bataclan concert hall.

Bilal Hadfi had been under surveillance from the Belgian authorities for possible links to

jihadi activities and yet he was able to evade them and participate in the Paris attacks.

The French authorities had launched an investigation on Sami Aminour in 2012 for terrorism

related activities and at that time he was suspected of planning to join militants in Yemen. He

missed four weekly police checks in 2013 and the authorities later lost track of him. An

international arrest warrant was issued against him and yet he managed to sneak into

France.

Last but not the least, the ringleader Abdelhamid Abaaoud was a high-profile ISIS recruiter

for Europe and was known to have links with several executed and foiled terrorist attacks in

France during the last one year. In July 2015, Abaaoud was sentenced in absentia to 20

years in prison for recruiting ISIS fighters to Syria. He was a most-wanted man, with several

European security agencies aware of his activities. And yet, he successfully organised the

Paris attacks by being personally present in the city.



The patent failure of domestic French intelligence services combined with the lack of

intelligence coordination with neighbouring European countries is a significant concern. The

fact that several known or suspected radical jihadists were able to conduct such an

ambitious attack under the agencies noses without detection does not auger well for the

security situation in the short term, as in the next 3-6 months, or perhaps longer.

Source comments from European intelligence agencies

Our sources within the European intelligence community have indicated that there is no point

in blindly blaming the French or Belgian intelligence services, as there just has not been

enough time to maximise intelligence sharing across countries where the refugees have

been walking through. Common feedback is that a Paris like incident was being anticipated

for some time. Both Italian and Greek authorities had already warned Europol and other

European security services that they could not provide any early warnings. Additionally, the

G20 meeting in Turkey was an important event which ISIS was well aware of and was likely

to capitulate on.

The main focus of the intelligence agencies now is how Abaaoud made his journey to Paris

without getting caught and coordinated the link up with the Molenbeek Cell. There were also

some unconfirmed reports about similar cells in Marseille and Rotterdam cells being

investigated.

The sources believe ISIS-Europe is taking their time in selecting targets and when that is

done, they will import personnel from Syria with the right training, who would also carry

orders from ISIS leadership to the locally converted recruits. One critique levelled against the

French intelligence was why they were not pushing their informants in the jihadist landing

pads of the Parisian suburbs earlier this year after Charlie Hebdo attacks?

It seems, in reality, these cells are well organised and insulated, and have impeccable

motivation. Something similar to family based units which were frequently found in

Iraq.

Our sources also mentioned that French and Spanish intelligence agencies, which had

Algerian or Moroccan problems for years, have planted a few of their informants in the

camps and on the „Europe-bound refugee highways‟. They are relying on embedding these

assets now to see when the next active cell will arrive. The expectation is that these agents

will spot Algerians, Tunisians, or Moroccans who do not fit the Syrian refugee profile, and

once identified, follow them and see what their operational objectives and structures are.

British intelligence is convinced that the 'flight of the Syria veterans' is already upon Europe



and that the refugee crisis is the perfect vehicle for them to penetrate past European border

protocols.

Our sources firmly believe that ISIS is not done with European capitals yet and they are

likely to hit France again simply to demonstrate they can act with impunity. Christmas and

New Year‟s Eve are likely to be the two dates to watch for.

Another source from the intelligence community within Europe mentioned that the Paris

attack in particular was a wakeup call and that it is actually the beginning of a campaign, and

France with such a large Middle Eastern and North African population is an easy target. The

potential attackers have the option of striking at will and lying low afterwards within the local

population. The same source also reported that Belgium is rushing through new laws on

refugees and immigration, which in the source‟s opinion indicate that the Belgian authorities

are feeling especially vulnerable.

Are the attacks over?

We have identified the following key factors behind the successful execution of the Paris

attacks:

1. ISIS senior leadership felt carrying out attack in Europe was in their strategic interest

2. ISIS had access to large number of European Muslims, who had travelled to Syria and

who were sent back to their respective nations to organise the attacks

3. The refugee crisis in Europe helped the perpetrators to infiltrate into the continent

without being caught, while some perpetrators had used their European passports to

legitimately enter the continent

4. The perpetrators had the technical skills and contacts to clandestinely procure weapons

from inside Europe

5. Under-funded European intelligence and law enforcement agencies are overwhelmed

by the scale of threat and simply lack the resources to properly monitor all potential

suspects

6. There exists large number of fanatics who are willing to give up their lives for their

beliefs

None of the six points as mentioned above has changed since the attacks of 13 November.

To the contrary the circumstances and conditions have worsened in the past few weeks. The

realistic prospect of further sleeper coordinators and support networks in existence across

Europe should give rise to significant concerns. However, although the numbers of



potentially trained and motivated jihadist planners and coordinators is nearly impossible to

quantify the risks must be addressed as soon as possible.

This particular problem could stretch well beyond Europe. There is a very real prospect that

these coordinators are now in place in other regions as well. With the French declaration of

war against ISIS in the wake of this incident, the British now launching air strikes, Germany

offering support for the efforts in the form of 1,500 support element troops presents the case

for a rapid expansion of ISIS tactics across Europe. Russia has a broad set of

considerations to be cognizant of, ranging from strategic interests in the Middle East to

Central Asia and societal and commercial interests across South East Asia.

The target pool for ISIS has suddenly exponentially grown in the past 6 weeks alone.

Therefore, the risks of ISIS carrying out further attacks in Europe are a very real prospect –

at least in the near term. The risks of ISIS popping up in random places, or ISIS ideologically

inspired lone wolves continue to rise alongside the more structured attack scenario. San

Bernardino in California is sadly the latest possible example of „radicalisation inspired

incidents‟.

Conclusion

As our analysis said some time ago the morphing of ISIS to a global network will continue to

be demonstrated through their ability to launch seemingly unpredictable attacks in vulnerable

European and other capital cities and divergence to lessor targets and back again to primary

targets. The evidence of this is now emerging in the form of both coordinated attacks and

„lone wolf‟ or „self-radicalised‟ attacks in different locations, continents apart in cases. It is a

stark reminder to the security services in many differing countries that they (ISIS) have the

strategic and tactical advantage and momentum. The continuous scaling up of police and

security services presence is unsustainable at the levels required as deterrents to ISIS or

radically inspired lone actors. They simply cannot be everywhere all of the time. This is part

of ISIS strategy, bring the war to Syria and Iraq and we bring it to your bustling cities and

sleepy towns and hamlets.

Intelligent Security Solutions Risk has been for some time indicating a geographically

enhanced capability of ISIS across different regions as being a growing risk. The evidence to

support this position is sadly mounting by the week. The threat trajectory is on a seemingly

steep upward spiral, and whether they act or not, the mere threat of acting is sufficient to

raise security concerns, deployments, reactions, heightened alert levels which can be in

place for lengthy periods, sapping the capabilities and reach of security services in the

process. Such sustained heightened levels of awareness and alerts also eventually over



time reduce the general public‟s sense of awareness. Ultimately this produces the situation

whereby complacency eventually replaces alertness, thus the cycle of over stretching and

sustainability of general awareness is eroded and vulnerability then returns.

The situation unfolding in Thailand in the past few days is both indicative of this strategy and

also troublesome in terms of the misinterpretation of the risks. Claims of up to 10 ISIS

operatives of Syrian extraction having entered Thailand with a view to striking Russian

associated targets are now being touted by multiple news agencies. Sources have indicated

that the original threat warning from the Russian Intelligence agencies indicated ‟perhaps 10

individuals from Syria have been dispatched to Thailand in October‟, it did not state they

were all of Syrian extraction. This perhaps explains the Thai police response that they „have

not been able to confirm the presence of these Syrians and called for calm‟. The specifics

of the dispersal of the suspects, four to Pattaya, two to Phuket, two to Bangkok and two to

an unknown location requires cautious examination. If such precise numbers and exact

locations are known or suspected then why not exact nationalities? Are the Thai authorities

out across the country looking for 10 unidentified „Syrians‟ or should they be throwing a drag

net across the localities looking for 10 unspecified nationalities arriving between the 15th to

the 30th of October? If such closed dates are proffered from where did the suspects hail?

Where was their port of arrival in Thailand? The process of elimination on such specific

intelligence, a narrow corridor of dates of arrival, and locations in Thailand believed or

otherwise to where the targets went, the port of departure and port of arrival would narrow

down search and identification parameters significantly. None of this has yet been explained.

Returning to the assessment that specific ISIS camps in Syria have been training an

unknown number of international recruits for deployment to other countries, such as those

behind the Paris attacks, the potential numbers of jihadists possibly trained and dispatched

from these camps remains totally unqualified in a quantifiable and verifiable manner. In

actuality, even the number of camps may not be really known. In short the world‟s

intelligence agencies essentially simply do not know the real or imagined numbers involved

nor their nationalities or their present locations. It presents a rather disturbing picture in

terms of where and when they can strike next.

Consequently, is Thailand now in the high risk category? Yes, it is and will remain so for the

foreseeable future. The August incident at the Erawan Shrine should be seriously reviewed

in light of recent events. The cell behind the attack has been presented in a very different

light by the Thai security services and the ruling Military government. The timeline for the

planning of the attack, the modus operandi of the attack, the mass casualty nature of it, the

cross regional make up of those behind the planning and execution, even down to the type



of explosives used all need to be re-examined. Certain elements bear similarities to the ISIS

modus operandi and the attacks in Paris, the timeline, the explosives the cell structure and

other similarities. However, given a large amount of physical forensic evidence was lost due

to the overzealous handling of the blast scene, to restore the impression of normality, the

comparative analysis on the composition and importantly – construction of the device, is

likely lost forever. That could have been contrasted to subsequent similar devices used

elsewhere. Bomb making techniques carry similarities and can tell a lot on origins. Perhaps

the strategy of denial of who was actually behind the incident and their motivations may now

be coming back to haunt the Thai security services and the Military government. (For our clients

in Thailand more detailed specific analysis of questions already asked of the agencies will be available inside the next

48 hours pertaining to the direct nature of unfolding risks.)

The scale of ISIS aspirations across Europe, Middle East, North Africa, East Africa, Central

Asia, South Asia and South East Asia are really yet to present themselves. In the interim

period the world‟s leaders and governments will respond as per the script written by the ISIS

strategists.

News & Politics

Paris Attacks, November 2015 - Assessment