Visualizing a Network From Open Sources

Uncovering (and Visualizing) Links Between the Brussels and Paris Attackers,

Inferring the Missing Pieces

Open Source Analysis• Lots of data from open sources in multiple formats• Dataset emerges over prolonged period of time from multiple sources. • No dataset complete• No dataset easy to analyze “as is”

– Approach inspired by Valdis Krebs, “Uncloaking Terrorist Networks” – published after 911. http://firstmonday.org/ojs/index.php/fm/article/view/941/863

• Research Question 1 - What can we assess about the Paris-Brussels attacks from open sources using the same approach?

• Research Question 2 – Can we detect missing links?• NY Times story on 9Apr2016 is the Point of Beginning (POB)…

– http://www.nytimes.com/interactive/2016/03/23/world/europe/how-the-brussels-and-paris-attackers-could-be-connected.html

One of the key connections between the two groups is Najim Laacharoui, the second suicide bomber at the Brussels airport, who made bombs used in both the Brussels and Paris attacks.

At least 14 individuals tied to both attacks were either Belgian or lived in Brussels. A number of the Paris assailants spent time together in Molenbeek, a working-class Brussels district. Salah Abdeslam, the only surviving direct participant in the Paris attacks, was able to hide among family and friends in Molenbeek before his arrest on March 18.

Many of the identified assailants in both plots had criminal backgrounds. Abdelhamid Abaaoud and Ibrahim Abdeslam spent time in the same Brussels prison. The Bakraoui brothers had been sentenced to prison for violent crimes, including carjacking and bank robbery.

Many of the individuals directly involved in the Paris attacks had traveled to Syria. Ibrahim el-Bakraoui was deported by Turkey back to Europe last year, suspected of being a terrorist fighter trying to enter Syria, Turkey’s president said.

Several of the Paris assailants had ties to terrorism that were known by the authorities before the attacks. Abdelhamid Abaaoud, for example, has been linked to several earlier plots. The federal prosecutor in Belgium said that an arrest warrant had been issued for Khalid el-Bakraoui in December by the judge investigating the Paris attacks.

Fingerprints of at least three Paris attackers were found in apartments rented by two of the Brussels bombers. Salah Abdeslam’s fingerprints were found in a Brussels apartment rented by Khalid el-Bakraoui and another one rented by Najim Laachraoui, who used it as a bomb-making lab. The fingerprints of two other Paris attackers, Bilal Hadfi and Abdelhamid Abaaoud, were found in a safe house, also rented by Mr. Bakraoui.

Many were of Moroccan descent or had relatives there. The parents of Abdelhamid Abaaoud, the suspected chief planner of the Paris attacks, were Moroccan immigrants to Belgium. The father of the two brothers in the Brussels attacks was a devout Muslim who had also emigrated from Morocco.

The assailants carried out most of the attacks in Brussels and Paris in groups of two and three. Salah Abdeslam had planned to help carry out attacks at the stadium in Paris, but backed out. Abdelhamid Abaaoud is believed to have been one of the assailants at the restaurant in Paris.

Synopsis

Lost in the details yet?

Geographic Clues: Sites Related to Paris and Brussels

Fingerprints of two Paris attackers were found in a house in Charleroi, near the French border. The house is believed to have been rented by Khalid el-Bakraoui, one of the Brussels attackers. DNA traces of Najim Laachraoui, a bombmaker involved in the Paris and Brussels attacks, were found in another house in Auvelais.

Ops TTPs• Extensive use of social media platforms such as Viber, Telegram

and WhatsApp, many encrypted for secure communication• Give operatives only as much information and money as they

need to reach the next phase; contacting them on each leg of their journey; and insisting on pseudonyms, even within teams.

• Constantly exchanged logistical advice with others in their network, including whether or not to use real names at border crossings and how to sneak across those borders illegally. One tip was to hide in train restrooms.– Used fake Syrian passports– Posed as Syrian refugees

2 Dead and 2 Arrested

Adel Haddadi Muhammad Usman

Ahmad al-Mohammad Mohamad al-Mahmod

“two suspected operatives?”

Two “Colleagues” Captured in Austria and Later Linked to Two of the Previously Unknown Attackers

Ahmad al-Mohammad

Mohamad al-Mahmod

Finally as a network…(again)

I took their series of graphics and built a NODEXL version. The NYTimes graphic was at:http://www.nytimes.com/interactive/2016/03/23/world/europe/how-the-brussels-and-paris-attackers-could-be-connected.html

Abu Ahmad

Ahmad al-Mohammad

Mohamad al-Mahmod

3rd Survivor - Abid Tabaouni • Tabaouni traveled from Syria along the refugee route• Tabaouni arrived, Austrian security officials thundered into the center, arresting

Haddadi, Usman and a few others suspected of being connected to the Paris attackers.

• Tabaouni had programmed his phone with a number linked to the terror cell of the ringleader of the Paris attacks, Abdelhamid Abaaoud.

• Haddadi denied knowing Tabaouni.– Tabaouni had saved Haddadi's phone number in his contacts.

• Tabaouni was also part of the same plot - arrested in Brussels in July.• Tabaouni was using a Facebook account that is identified by its unique ID number

and was publicly posting updates from Belgium• Haddadi and Usman were extradited to France• Probably more sleeper cells and ISIS operatives coming into Europe using the same

crowded, chaotic refugee route (COSMIC INSIGHT!!)

Connected??• Abdelhamid Abaaoud contacts

– Reda Hame, recruited for IT expertise– Ibrahim Boudina, part of a cell of 22 men radicalized at a

mosque in Cannes– Mehdi Nemmouche – killed 4 at the Jewish museum of Belgium– Faiz Bouchrane – caught in Lebanon; in custody– Ayoub El Khazzani – caught by US troops on vacation on high

speed train– Dozens of others arrested in France, Spain, Belgium and

Germany

Key OS Research Links (some of)• http://www.cnn.com/2016/09/05/politics/isis-suspects-terrorism-euro

pe-documents/

• https://www.washingtonpost.com/world/europe/official-paris-gas-canisters-suspect-pledged-loyalty-to-is/2016/09/09/efb70dca-766d-11e6-9781-49e591781754_story.html

• http://www.nytimes.com/2016/03/29/world/europe/isis-attacks-paris-brussels.html

• http://www.nytimes.com/interactive/2016/03/23/world/europe/how-the-brussels-and-paris-attackers-could-be-connected.html

• http://www.wsj.com/articles/terror-networks-web-sprawls-beyond-brussels-and-paris-1459124085

>70% of Americans now have a smartphone…and spend nearly 2 hours a day on social media

Social Media Sites

What Do You See Here?Any Given Moment in a Large City

What Do You See Now?Any Given Moment in a Large City