The inside story of the Paris attack
Paul Cruickshank
The night that shook Paris started with three rental cars: three cars with three teams of terrorists maneuvering through the Friday evening traffic armed with the weapons of war.
A little before 9 p.m., a Renault Clio driven by Salah Abdeslam, the Paris plotter captured on Friday in Brussels, pulled up outside the national stadium. An international soccer friendly match between France and Germany was just kicking off and 80,000 fans, including French President Francois Hollande, were already inside. Three men exited the car and headed toward the stands.
One of them -- Bilal Hadfi, a young French citizen living in Belgium -- can be seen on surveillance video speaking into a cell phone. The other two were Iraqis who had slipped into Europe weeks before by posing as refugees. One of the trio was dressed in a Bayern Munich jogging suit. Concealed underneath their clothes were shrapnel-filled suicide vests held together with tape.
A few miles away, a black Seat Leon weaved toward the busy cafe district of Paris. The man behind the wheel, an already notorious Belgian ISIS operative called Abdelhamid Abaaoud, was on the phone speaking to Hadfi at the stadium to make sure everything went according to plan. In the passenger seats, two of his childhood friends, Chakib Akrouh and Saleh Abdeslams older brother, Brahim, clutched their Kalashnikovs, readying themselves.
Not far away a black Volkswagen Polo with another trio of heavily armed terrorists headed toward the Bataclan concert hall, where hundreds had gathered to hear the American rock band Eagles of Death Metal perform. The French ISIS fighters in the car -- Ismael Omar Mostefai, Samy Amimour and Foued Mohamed-Aggad -- had all recently been on the front lines in Syria, and were moments away from carrying out the worst massacre in the modern history of France.
A drumbeat of terror
Several months earlier, an ISIS media team in Syria arranged for the attackers to be filmed in a gruesome propaganda video. Nearly all the attackers who later gathered in Paris are seen clutching the throats of prisoners in orange jumpsuits before beheading them. If its not with our knives it will be with our Kalashnikovs. Its an order from our emir Abu Bakr al-Baghdadi to fight you in your lands, and Allah willing our appointment will be on the Champs Elysees, declared the future Bataclan attacker Mostefai.
Western intelligence agencies believe the top leadership of ISIS signed off on the Paris plot. The group has set up an external operations division reporting up to Abu Mohammed al-Adnani, one of Baghdadis top deputies, according to U.S. officials.
Laying the groundwork
Abaaoud was assigned the task of leading the attack team in Paris. Radicalized in jail in Belgium for a string of robberies he committed with Saleh Abdeslam, he had risen up the ranks of ISIS after first traveling to Syria from Belgium in early 2013. The following year, Abaaoud briefly returned to Belgium to abduct his 13-year-old brother Younes, who his family believes has since been killed in Syria, according to French police documents. On his return to Syria, according to the testimony of a French ISIS fighter, Abaaoud had been assigned to an internal security unit of ISIS, before being tasked with organizing plots against Europe.
In late 2014, Abaaoud slipped into Greece and from an Athens apartment issued coded instructions to an ISIS cell in Belgium preparing a major gun and bomb attack. But Belgian security services got wind of the plot and in January 2015 neutralized the immediate threat in a fierce gun battle on the cells safe house in Verviers in eastern Belgium.
Abaaoud escaped the dragnet and returned to Syria. According to French police documents, one of those interrogated in Belgium in the weeks after the plot was thwarted was Abaaouds childhood friend Salah Abdeslam, who claimed he did not share Abaaouds radical views.
Back in ISIS Syrian de facto capital, Raqqa, Abaaoud worked feverishly with several other French-speaking ISIS operatives to set in motion a string of plots against France.
A key figure in the group was Fabien Clain, a veteran French jihadi about 10 years Abaaouds senior, who European intelligence agencies believe is a driving force behind Dar al-Islam, ISIS French magazine. Before arriving in Syria, Clain had spent jail time in France for recruiting for al Qaeda in Iraq and, as CNN has previously reported, also threatened to attack the Bataclan concert hall.
During the course of 2015, Dar al-Islams repeated threats against France did not escape the notice of European counterterrorism officials. The day after the Paris attacks, it was Clain who claimed responsibility on behalf of ISIS, suggesting he played a senior role in the conspiracy.
Opinion: Whats at stake if Paris suspect talks -- or doesnt
Looking for recruits
According to a senior Belgian counterterrorism official, Clain and Abaaoud were on the lookout for fresh recruits who could be given quick training for a week or two then sent back to Europe to launch attacks.
The first plot Abaaoud and Clain allegedly instigated was a plan by Sid Ahmed Ghlam, a Paris-based student, to attack a church in Paris. Ghlam made two trips to Turkey, where he met with operatives connected to Clain who assigned him to launch an attack. The plot was thwarted in April 2015 after Ghlam accidentally shot himself in the leg.
In June 2015, Nicholas Moreau, a French suspected ISIS recruit, was taken into custody by French authorities after being deported from Turkey. He was later charged with being part of a conspiracy with relation to a terrorist enterprise. Under interrogation, he claimed Abaaoud was the principal commander of future attacks in Europe and had been charged by ISIS with examining the background of potential recruits for those attacks, according to French police documents. Although analysts believe Moreau exaggerated Abaaouds importance, it was clear he was quickly becoming one of the caliphates most dangerous operatives.
Belgium: Europes front line in the war on terror
Weapons training in the park
That same June, Abaaoud assigned Reda Hame, a French ISIS recruit, to return to France and launch an attack on a crowded concert venue. Hame claimed he had backed out of the planned attack when he was arrested by French authorities.
CNN has obtained the transcript of his August 13 interrogation by French police. Rame claimed he had been provided hands-on weapons training, including in the use of Kalashnikovs and grenades, by Abaaoud in a park in Raqqa in early June. According to Hame, Abaaoud gave him his assignment, choosing an easy target, like a group of people, a concert for example, where there is a crowd. He specified that after carrying out the attack I should wait for security services to arrive and die while taking out the hostages. He added that if lots of civilians were hit, the foreign policy of France would change.
A few minutes later Hame was asked if he was aware of any attacks in the works against France. All I can tell you is that its going to happen soon. Its a veritable factory over there -- they are really looking to hit France or Europe, Hame replied.
There were also links to Abaaoud in an attempted attack on a high-speed train heading toward Paris later in August 2015, which was thwarted by the heroic intervention of three Americans. The gunman, Ayoub el Khazzani, had connections to associates of Abaaoud, according to French police documents.
Moving fighters into Europe
Although investigators do not have yet have a complete picture, they believe most of the 10-man attack team entered Europe in the late summer and early autumn of 2015.
On August 3, Salah Abdeslam took a ferry from Greece to Italy in the company of Ahmed Dahmani, a Belgian associate. It is not clear if they were on their way back from Syria. All 10 of the Paris attackers, except Salah Abdeslam, were featured in an ISIS video released after the attack, filmed in Syria. Dahmani, who investigators believe was part of the broader Paris attack conspiracy, was subsequently arrested in Turkey after boarding a flight from Amsterdam the day after the attacks.
On September 9, Salah Abdeslam drove to Hungary from Belgium in a rented Mercedes, on one of two trips that month that Belgian investigators suspect were to pick up members of the cell who had worked their way from Syria through Greece and the Balkans.
In the car with him were two ISIS operatives Belgian investigators believe outranked Abaaoud in the Paris attack conspiracy. One of them was Mohamed Belkaid, an Algerian ISIS operative who had once worked as a confectioner and was killed in a firefight in the safe house where Salah Abdeslam was hiding in Brussels. The other man used the fake name Soufiane Kayal and is still at large.
Abaaoud himself had slipped into Europe by the end of September. Investigators later established through eyewitness accounts that he had been present at some point that month on the Greek island of Leros. It is still not clear whether he disembarked in Leros or went there to pick up other members of the cell.
On October 3, the two Iraqis tasked with blowing themselves up at the Stade de France disembarked on Leros from a boat carrying almost 200 migrants. They used doctored Syrian passports to register as refugees and then took a ferry to Athens, before traveling through the Balkans to Hungary, then Austria. They then joined the other members of the conspiracy in Belgium.
The bomb factory
Investigators have established the group gathered in at least three safe houses in Belgium in the weeks before the attack. An apartment they rented on Rue Henri Berge in the Brussels district of Schaerbeek on September 1 served as the bomb factory. Here the group manufactured the high explosive TATP and inserted it into suicide vests. It is not yet known who made the bombs. A sewing machine used to stitch together the vests, as well as the fingerprints of Salah Abdeslam, were later found at the property.
According to Belgian public broadcaster RTBF, the apartment was rented by Mohammed Bakkali, a Belgian extremist. He -- along with Salah Abdeslam, Mohammed Belkaid and the man using the fake identity Soufiane Kayal -- played a key role in the logistics and planning of the attack, officials told CNN. Bakkali was arrested in Brussels on November 26 and faces trial. According to a senior Belgian counterterrorism official, police recovered surveillance footage at his residence of an official working at a Belgian nuclear site.
On September 3, the conspirators rented an apartment on Rue de Fort in Charleroi, Belgium, where Abaaouds fingerprints were subsequently found. And on October 5, the senior conspirator using the fake identify Soufiane Kayal rented a large villa with a climate-controlled cellar in the small town of Auvelais near Charleroi, where traces of Abaaouds presence were also found, according to a senior Belgian official.
Between November 11 and November 13, rental cars arranged by Salah Abdeslam shuttled back and forth to Belgium, ferrying the attackers to Paris. After the attacks, authorities recovered surveillance footage showing the attackers stopping off at various highway service stations en route. One of the drivers, Mohamed Abrini, a Belgian-Moroccan from Molenbeek, is still at large.
The Bataclan attackers congregated at the City hotel in the Paris suburb of Alfortville. Syringes were later found in one of their rooms which investigators believe were used to add the final detonating chemical necessary to arm the suicide vests.
The stadium and cafe attackers stayed at a dilapidated house on the Rue Georges Tarral, in the northeastern suburb of Bobigny, rented by Brahim Abdeslam. At 8:30 p.m. on November 13, an eyewitness saw a Renault Clio pulling away from the residence. Driven by Salah Abdeslam, it made its way toward the national stadium just a few miles away in Saint-Denis.
A night of terror
It is still not clear why the stadium attackers arrived slightly late for the game, but eyewitness accounts suggest they did not have tickets. A security guard at Gate R told French police that starting at 9.05 p.m., he blocked a man resembling one of the Iraqi stadium attackers four times from trying to trick his way in, according to French police documents. One eyewitness interviewed by police remembered seeing three attackers, including Salah Abdeslam, talking to one another after being refused entry into the stadium.
Last week, Abdeslam claimed he had been assigned to blow himself up at the stadium but backed out, according to Paris prosecutor Francois Molins, who said the claim should be treated with caution.
The French police reports makes clear that eyewitness accounts are not always reliable and, in the case of the many interviewed after the Paris attacks, were sometimes contradictory. What is clear is that at a certain point after dropping off the stadium attackers, Salah Abdeslam drove away with his suicide vest.
Explosion at the Stade de France
At 9:20 p.m., the first of what would be several large bangs thundered across the stadium. The Iraqi suicide bomber -- who, according to the security guard had been trying to trick his way in -- blew himself up outside Gate D, killing one other person. A doctored Syrian passport in the fake name of Ahmad al Mohammad would later be found near what remained of his right foot.
At the moment of the first blast, Bilal Hadfi, the young Belgian member of the stadium attack team, was still on the phone with Abaaoud, the plot ringleader, who was impatiently maneuvering his Seat rental car through the traffic on Rue Bichat so that he could reach the cafe district. Inside the car were his childhood friends Brahim Abdeslam and Chakib Akrouh. The elder Abdeslam brother had traveled from Belgium to Syria in January 2015, where like Akrouh he had joined ISIS.
Kalashnikov fire in the cafe district
Their attack began at 9:25 p.m. when a car in front of Abaaoud blocked his path. Five shots were fired from the Seat Leon, killing the driver of the car. According to some eyewitnesses, Abaaoud stopped the car in the middle of the road turning on the blinking hazard lights. Shouting Allahu akbar, Arabic for God is great, all three terrorists then got out of the vehicle and sprayed the terrace and windows of the Cambodage and Carillon cafes with their Kalashnikovs, killing 13 people.
At 9:30 p.m., a second bang was heard in the stadium. A second suicide bomber, dressed in the colors of Bayern Munich, detonated his vest outside Gate H. Fortunately, no one was killed. Hollande, the French President, would soon be evacuated from the stadium. The third suicide bomber detonated his explosive vest twenty minutes later, next to a McDonalds restaurant near the stadium, injuring over 50, including seven seriously.
At the time of the second explosion at the Stade de France, the Seat Leon was at a new location. At 9:32 p.m., Abaaouds team got out of the vehicle, again shouted Allahu akbar and opened fire at revelers at the Casa Nostra and Bonne Bierre cafes near the Place de la Republique, killing five. One of the surviving eyewitnesses noticed one of the shooters was wearing orange sneakers, Abaaouds footwear selection that night.
The killers then jumped back in the car. At 9:36 p.m., the cafe killers opened fire on La Belle Equipe cafe, killing 19. As at the other cafes, most of those who lost their lives were sitting on the outdoor terraces. Eyewitnesses later recalled the gunmen did not speak to each other as they calmly sprayed the cafes and cars traveling down the road with bullets.
The car again sped off to a new location. At 9:40 p.m., Abaaoud dropped off Brahim Abdeslam at the Comptoir Voltaire cafe. According to eyewitnesses interviewed by police, he was wearing a hooded jacket over several layers of clothing when he brusquely entered the covered interior terrace of the establishment. He smiled at the other patrons, then blew himself up. Their killing done for the night, Abaaoud and Akrouh drove up toward the Montreuil suburb of Paris, where they would abandon the car.
The Bataclan attack: Were starting
At around 9:40 p.m., Bataclan attackers Ismael Omar Mostefai, Samy Amimour and Foued Mohamed-Aggad parked their Volkswagen Polo in front of the concert hall. At 9:42 p.m., one of them took out a Samsung smartphone and sent a last text to a cell phone located in Brussels: Were getting going; were starting. They then tossed the Samsung phone into a garbage can near the entrance of the Bataclan.
The phone was later recovered and has provided key information to investigators. They believe the men who received the text message were Mohammed Belkaid, the Algerian ISIS operative killed last week in Brussels, and the man using the fake identity Soufiane Kayal, who they believe were in the same room together that night in Brussels. In total, 21 phone calls and 2 text messages were exchanged between the Samsung phone and the cell phone geolocated in Belgium after the latter phone went active, 24 hours before the attack.
Investigators believe Belkaid and Kayal provided direction to the Paris attackers from Brussels before, during and after the night of the attacks, using multiple cell phones. According to French police reports obtained and viewed by CNN, the second of those cell phones, geolocated in precisely the same area in Belgium as the first, was communicating with Bilal Hadfi at the stadium and with Abaaouds cafe team as the attacks unfolded, suggesting the attack was being coordinated in real time from Brussels.
The encryption app
Several hours earlier, at 2:14 p.m., while they were still at the Alfortville hotel, the Bataclan attackers had downloaded the encryption messaging app Telegram onto their Samsung smart phone, according to police reports. No recovered content from the messaging app is mentioned in the French police documents, suggesting there were likely communications by the Bataclan attackers that will never be recovered.
As well as offering end-to-end encryption, the Telegram messaging app offers an option for users to self-destruct messages. At 4:39 p.m. on November 13, one of the attackers downloaded detailed floor plans of the Bataclan venue onto the Samsung phone and conducted online searches for the American rock band playing there that night, the Eagles of Death Metal.
Almost all of the 89 people killed inside the Bataclan lost their lives during the first 20 minutes of the attack. The gunmen first killed three people on the sidewalk outside the concert hall, then entered and moved to the floor area of the venue, peppering the concertgoers with automatic fire, while shouting Allahu akbar.
Inside the Bataclan
As one fired his weapon, the other reloaded so they could kill as efficiently as possible. Researching the floor plans appears to have paid off for the perpetrators. As some of those inside tried to escape through an emergency exit, they found a third terrorist waiting for them on the other side, according to the French police documents.
According to the eyewitnesses cited in the French police documents, the attackers spoke perfect French, taunting those lying wounded on the floor of the concert hall by saying, Anybody who moves, Im going to kill.
Where are those Yanks?
After the initial wave of killing, the gunmen stopped and asked each other Where is the singer? Where are those Yanks? Its an American group, youre bombing us with the Americans, so were going to hit the Americans and you, according to an eyewitness cited in the police documents.
The terrorists then addressed those fighting for their lives on the floor, telling them they had been dispatched from Syria by ISIS to carry out the attack to avenge French airstrikes in Iraq and Syria.
At 10 p.m., two local French police officers arrived at the venue. Although only armed with handguns, they managed to take out Samy Amimour. As Amimour fell mortally wounded to the floor, he triggered his suicide vest. According to police documents cited by Le Monde, when the other two terrorists opened fire on the police officers from above, they were forced to retreat.
The two surviving terrorists, Mostefai and Aggad, then took some of the surviving hostages, and according to documents cited by Le Monde, herded them to an L-shaped corridor deeper inside the building. According to police documents obtained by CNN, by then the terrorists had seized several cell phones from concertgoers to try to access the Internet but could not find a signal.
Hostage rescue
By 10:45 p.m., Frances rapid response commandos, a unit known as RAID, were on the scene. According to the French police documents obtained by CNN, they started communicating with the hostage-takers from outside the corridor via cell phone. The terrorists threatened to start executing their prisoners unless they received a signed paper promising that France would leave Muslim lands.
At around that time, Abdelhamid Abaaoud, the Paris team leader, was spotted by a witness outside the Bataclan concert hall, apparently barking orders into a hands-free cell phone to the two surviving terrorists inside. Investigators later traced the cell phone he was using that night to the area outside the Bataclan. After abandoning the Seat Leon in Montreuil, he had ridden the metro back into the center of town to coordinate the final phase of the attack. - CNN
