Paris attacks: Directives came from operatives in Brussels, investigators say

Belgian investigators believe two terrorist operatives who are still at large gave orders to the Paris attackers in calls from Brussels, a senior Belgian counterterrorism official told CNN.

Grainy black and white pictures of the two men were circulated by Belgian authorities in the aftermath of the attacks, but this is the first time their suspected senior role has been disclosed.

The content of the calls, which were intercepted by Belgian authorities, made clear they occupied a more senior role than Paris ringleader Abdelhamid Abaaoud, the official told CNN.

“They were givers of orders and were higher up in the hierarchy of the conspiracy. Abaaoud was clearly not the overall leader in Europe,” the official told CNN.

The official said some of the calls were made after the Paris attacks on November 13 and before French police raided a safe house in the suburb of Saint-Denis in the early hours of November 18.

On December 4, the federal prosecutor’s office in Belgium released pictures of what it said were “armed and dangerous” men who used false Belgian identity papers to help attack suspect Salah Abdeslam travel to Hungary in September and transfer money to a female cousin of Abaaoud after the attack.

The identity cards carried fake names, Soufiane Kayal and Samir Bouzid, as Belgian nationals.

The senior Belgian official told CNN that investigators are now close to confirming their real identities. At least one of them is believed to be a Belgian national.

The official indicated the phone calls were separate from other previously disclosed communications between the Paris attackers and at least one operative in Belgium.

Last month, a senior Belgian counterterrorism official and a source briefed on the French investigation told CNN that 25 messages were swapped between a Samsung phone retrieved outside the Bataclan concert hall and a phone at the time located in Belgium in the 24 hours before the attack, and that Abaaoud was also in contact the night of the attacks with a second phone located in the same area in Belgium. The last message sent from the Bataclan was, “About to start.”

The senior Belgian official told CNN there was constant communication between the attackers and individuals in Belgium during the period leading up to the attack, the night of the attack itself and afterward.

The duo using the ID cards were in a Mercedes with Abdeslam that was stopped at the Austria-Hungary border September 9, about two months before the November 13 attacks, the prosecutor’s office said in December. Both men, the office said, used the fake Belgian identity cards to cross the border with Abdeslam, whose identity also was checked there.

The office said Abdeslam twice visited Hungary’s capital, Budapest, in September. At the time, the prosecutor’s office did not elaborate on the purpose of the trip. The senior Belgian official told CNN that investigators now suspect some of the trips were to pick up some of the Paris attackers who had made their way to Hungary from Syria.

Last month, Belgian authorities said one of the two suspects transferred money to the now-dead female cousin of Abaaoud.

The man, using the false Samir Bouzid identification card at a Western Union outlet in the Brussels area, wired 750 euros ($807) to Hasna Ait Boulahcen on November 17, the Belgian prosecutor’s office said. Both of the publicized suspects – the men going by the names of Kayal and Bouzid – were at the store from which the money was sent.

The senior Belgian official told CNN that investigators believe the money was sent so Abaaoud could pay for lodgings in Paris after the November 13 attacks. The official said Abaaoud had requested the duo send him money.

Authorities released color surveillance images of the men in the Brussels-area store from which the money was sent to Ait Boulahcen. They also released the black-and-white images; they did not say whether those images were part of the false ID cards.

Abaaoud, Ait Boulahcen and an unidentified man died during a police raid on an apartment in Saint-Denis on November 18, the day after the money transfer. After the raid, investigators learned that Abaaoud and the other man who died in the raid were planning a suicide attack on the Paris financial district of La Defense on November 18 or 19, according to Fran?ois Molins, the Paris prosecutor.

Precise picture of preparations

The Belgian official told CNN that investigators now had a precise idea of how the Paris attacks were planned and prepared, including the residences and cars used.

They said that among the 10 arrested in Belgium with links to the Paris attacks were some suspected of playing a leading role in the conspiracy.

Mohammed Bakkali, who was arrested on November 26 in Brussels, is suspected of playing a leading planning role. Bakkali, who the official said has a history of links to petty crime, remains in custody and neither he nor his lawyer have publicly commented on his arrest.

Others, including the two identified on the black and white photos and the so-called eighth attacker Abdeslam and Mohammed Abrini, who drove him to Paris, remain at large.

Three Belgian security sources, including two senior officials, told CNN that Belgian media reports, widely picked up by the international media, that Abdeslam had possibly been present at an address in Molenbeek on November 16 and may have escaped because of restrictions on nightime raids were not accurate. They say the trail for him went cold on November 14 the day after the attacks. His last known location was the Brussels district of Schaerbeek.

Investigators say they have identified the safe house in Belgium in which the explosive vests used in the Paris attacks were made, as CNN was first to report last month.

The bombs were made in an apartment in Schaerbeek, according to the Belgian official, a district which borders the areas where the headquarters buildings of the European Union are situated. Authorities found traces of explosives in the apartment and even retrieved the sewing machine used to stitch together the explosive vests, according to the senior Belgian official.

The plotters had tried to clean the apartment of traces of explosives but had not cleaned it well. Traces of the explosive TATP were found by investigators in other locations in Belgium.

Investigators believe the suicide vests were transported to Paris before the night of the attacks. They believe that at that point only the detonators for the device needed to be completed. They believe that syringes found at a hotel in Alfortville on the outskirts of Paris were likely used by the attackers to secrete an explosive substance into the detonating mechanism, according to the Belgian official.

New strategy: Faking their deaths

The plotters also used a villa in Auvelais in southern Belgium as a safe house, the Belgian official told CNN. The false identification of Kayal was used to rent the house in Auvelais, which was searched on November 26. The official said a friend of Abrini had also been linked to the address. Belgian media have also linked Bakkali to the residence.

The official told CNN it was still not clear when or how Abaaoud made his way to Europe, but investigators have established he spent time in Belgium in the weeks before the Paris attacks.

“Given very few Belgians have biometric passports it would not have been difficult for him to enter Europe. He could easily have used a passport of someone that resembled him,” said the official.

In late 2014 Abaaoud had faked his own death to get into Greece to coordinate a plot thwarted in the eastern town of Verviers in Belgium last January, CNN previously reported.

A senior European counterterrorism official told CNN that recent intelligence indicates that an increasing number of European ISIS operatives are faking their own deaths. The official said the worry is they are doing this so they can return to Europe to potentially carry out attacks.