First on CNN: ISIS planned for more operatives, targets during Paris attacks

The sophisticated ISIS network that plots foreign strikes had planned for the carnage in the November 2015 Paris attacks to be far worse, to occur in other European countries as well and, investigators believe, had planned to follow them up with strikes in several locations, CNN has learned.

CNN has obtained thousands of pages of documents and photos from internal European investigations and gathered information from sources close to the Paris investigation that together provide new details about the highly organized terror group intent on attacking overseas targets.

These documents reveal new information about two captured operatives who investigators believe intended to attack France. They also point, chillingly, to the existence of another suspected terrorist – never before named publicly – who authorities claim is linked to the Paris terror cell and was on the loose in Europe for months after that attack. That man, identified by authorities as Abid Tabaouni, was only arrested in July.

And the documents shed new light on the highly organized branch of ISIS devoted to plotting attacks inside Europe where, even now, sources told CNN, operatives await instructions from senior handlers in Syria.

“ISIS is increasing its international attack planning,” said Paul Cruickshank, a CNN terrorism analyst who contributed to CNN’s investigation and editor of CTC Sentinel, a publication issued by the Combating Terrorism Center at West Point. “It’s increasingly sophisticated in the way it does this. It’s set up an intricate, logistical support system for these terrorists … to launch these terrorist attacks.”

A CNN team spent months going through 90,000 pages of documents, most of them in French, that included a trove of interrogations, investigative findings and data pulled from cell phones offering insight into the external operations wing of ISIS known as the Amn al-Kharji.

The documents show:

A senior European counter-terrorism official who spoke to CNN said that according to investigations into the network that carried out the Paris attacks, they were a slimmed-down version of an even more ambitious plan to hit Europe.

After interrogating suspects and gathering intelligence, European investigators now believe that ISIS initially planned for the operatives it sent last year to also attack the Netherlands, as well as other targets in France including shopping areas and possibly a supermarket in Paris, the official said.

In addition, recently obtained intelligence indicates that ISIS has stepped up efforts to infiltrate operatives into the UK to launch attacks there, an official told CNN.

The senior European counter-terrorism official told CNN that security services were “uncovering more and more ISIS operatives” on continental European soil. ISIS operatives dispatched back to Europe have taken advantage of encryption, especially the Telegram messenger app, to communicate securely, the official told CNN, frustrating European security services.

“Encrypted messaging groups have the potential to revolutionize terror plot planning by allowing entire cells to coordinate in real time without compromising themselves,” said CNN terrorism analyst Paul Cruickshank.

Europe’s security agencies have had important successes, though. One major breakthrough was the capture of two men who authorities believe intended to travel to France alongside the two suicide bombers who eventually blew themselves up outside a Paris stadium.

Investigators: Two ISIS attackers who never reached France

Those two suspected ISIS operatives are identified in the documents as Algerian-born Adel Haddadi and his Pakistani travel partner, Muhammad Usman.

Documents that detail their capture and extensive interrogations, particularly with Haddadi, show how ISIS supported the attackers throughout their journey from Syria through Europe – and how future attacks might be organized. The following account of their journey to Europe is based on those documents, which include evidence gathered by investigators, and their conclusions.

Haddadi and Usman, who was identified by investigators as a suspected bombmaker for the Pakistani terror group Lashkar-e-Taiba, set out from the capital of the self-declared ISIS caliphate in Raqqa, Syria, six weeks before the Paris attacks.

They were part of a team, investigators concluded. The two others, Ahmad al-Mohammad and Mohamad al-Mahmod, would later blow themselves up outside the national stadium in Paris. The team crossed the border from Syria into Turkey in early October and headed for the Turkish coast.

The four men didn’t seem to know each other’s real names, or what their final mission would be. All Haddadi knew, he later told interrogators, was that they were being sent to France to do “something for the good of God.”

The documents show that their journey was directed by a shadowy ISIS leader in Syria, known only as Abu Ahmad. Operating like a puppet-master from afar, Abu Ahmad handled their logistics: connecting them with smugglers and cars for transport, providing pre-programmed cell phones and getting them fake Syrian passports.

He wired them money as they moved, using intermediaries who couldn’t be traced, and communicated using encrypted apps.

“Abu Ahmad … is key in sending those individuals, at least the foreigners, into the Paris attacks,” said Jean-Charles Brisard, president and chairman of the French Center for the Analysis of Terrorism, who reviewed the documents for CNN.

“He is the one who recruited them, who funds them, who trained them,” said Brisard. “He was always in contact with them.”

Throughout their journey, Abu Ahmad gave the men only enough money and information to get to the next stop, rarely if ever telling them what would happen next, the documents show.

Posing as Syrian refugees

The documents reveal fresh details about their journey and the way they posed as Syrian refugees, blending in with thousands fleeing the war-torn country.

They made the treacherous crossing from Izmir, Turkey, into Greece in a boat filled with dozens of refugees. But they were then intercepted by the Greek Navy.

The two who would go on to strike the Paris stadium passed through Greece and started moving across Europe toward their target in France. Greek officials declined to explain how the two got through.

But Greek authorities discovered Haddadi and Usman’s fake Syrian passports. The pair were arrested, their money was taken, and they were held for nearly a month.

Sources told CNN that investigators believe that delay was significant; as a result, they would not have a chance to become part of the Paris attacks.

The Greeks released Haddadi and Usman in late October. They immediately contacted their ISIS handler, Abu Ahmad, who arranged for someone to wire them 2,000 euros. Flush with cash, the pair continued along the refugee route.

It was likely a quiet journey.

The documents show that Usman spoke only Urdu, while Haddadi spoke mostly Arabic. And as they travelled north, Usman was preoccupied with a strikingly un-Islamic hobby – using his phone to peruse almost two dozen X-rated sites, including “sexxx lahur” and “Pakistani Lahore college girls … ImakeSex.”

Both men’s phones have given European officials rich investigative veins to mine, revealing dozens of contacts across Europe and the Middle East.

One of the people Haddadi reached out to for help was a technician at one of the most important nuclear research centers in Europe. That man was placed under immediate observation by French authorities, the documents show.

Data pulled from the phones also revealed how the operatives functioned both with extreme care and sometimes, seemingly, by the seat of their pants. In one exchange, Haddadi asks a contact for advice about what to do at a border crossing and whether a friend should use his real name. The friend is so worried about this, Haddadi gripes that he’s “driving me crazy.”

Other online conversations, notably with Abu Ahmad, are clearly in code. One message investigators pulled from Haddadi’s phone shows the ISIS handler counseling patience, though the exact meaning of his message isn’t clear. “Yes, but not yet,” it reads, “the drugs are not good.”

On November 14, the day after the Paris attacks, Haddadi and Usman arrived in Salzburg, Austria, applied for asylum and settled into one of the city’s refugee centers, where they waited for weeks.

Investigators: Planning for another strike

They were waiting with a purpose, according to the documents.

European investigators concluded that Haddadi and Usman were part of the same terror cell as the Paris bombers and, having failed to participate in that bloody day, were planning another strike.

Investigators found that in the days before their arrest, Haddadi and Usman were researching trains to Paris and making a flurry of phone calls overseas, including to contacts in Belgium and France.

The documents also reveal that investigators believe that Haddadi and Usman were waiting for a third man to join them – Abid Tabaouni.

Tabaouni’s name and his alleged role have never before been made public.

As investigators grilled Haddadi and pored through data they collected from cell phones, they asked European police to issue a continent-wide warrant for Tabaouni’s arrest.

Like Usman and Haddadi, Tabaouni traveled from Syria along the refugee route, arriving in Salzburg on December 10. He headed to the refugee center where Haddadi and Usman were staying.

The documents outline what happened next: The very day that Tabaouni arrived, Austrian security officials thundered into the center, arresting Haddadi, Usman and a few others suspected of being connected to the Paris attackers.

Tabaouni was nowhere to be seen. But investigators found his cell phone charging right beside Haddadi’s bed.

The documents show that Tabaouni had programmed into his phone a number linked to the terror cell of the ringleader of the Paris attacks, Abdelhamid Abaaoud. He had also saved a photo of ISIS fighters standing before their black-and-white flag.

Haddadi denied knowing Tabaouni, but investigators found Tabaouni had saved Haddadi’s phone number in his contacts. The phone also contained a photo taken just 30 minutes before security officials stormed the refugee center. It shows Tabaouni sitting on a bed in between where Haddadi and Usman slept.

The investigators lay out in the documents their belief that Tabaouni was coming to join Haddadi and Usman and that the three men were working on ISIS operations and planning possible attacks.

CNN sources and analysts agree about Tabaouni’s likely role.

“We can assume that Tabaouni was also part of the same plot,” said Brisard, the French terror expert. “And (that he) was instructed to carry out an attack.”

From the moment he slipped away in December, Tabaouni was a wanted man, according to several CNN sources.

An arrest is made

The Belgian prosecutor’s office told CNN that Tabaouni, who is Moroccan, was only arrested in Brussels in July. He was taken into custody as soon as he was located, according to a senior European terrorism official. Following the publication of an earlier version of this story, Austrian media, citing prosecutors, have reported that Tabaouni has been extradited to Austria.

Haddadi and Usman were extradited to France, where they face terrorism charges, according to senior European counterterrorism sources, who also say they will be trying to tie Tabaouni to Haddadi and Usman and the Paris attackers.

While he was on the loose, Tabaouni was openly using a Facebook account that is identified in the documents by its unique ID number and was publicly posting updates from Belgium, where he was arrested. None of his postings indicate any apparent terrorist leanings or affiliations.

Investigators are now analyzing more than 1,600 pages of data from Tabaouni’s phone in hopes of learning more about his movements and contacts.

Several sources told CNN there are probably more sleeper cells and ISIS operatives coming into Europe using the same crowded, chaotic refugee route exploited by Haddadi, Usman and Tabaouni.

“We’ve seen that in the recent weeks, several of them, individuals who carry out individual attacks, inspired attacks, were coming back from Syria using the same route,” Brisard said.

“In addition to that, several jihadists have been arrested all around in France … in Belgium and Germany using the same route, for the same purpose,” Brisard said.

The treasure trove of information that investigators gained from the interrogations and the data extracted from the phones may help authorities better identify future plotters. Even after the arrests in Austria, Haddadi’s phone was still active.

On December 15, five days after the refugee center raid, the documents show that the team’s ISIS handler, Abu Ahmad, reached out to his operatives. He messaged Haddadi, perhaps wondering about their silence.

“How are you,” he wrote. “What has become of you?”

There was no reply.

CNN’s Patricia DiCarlo and Meghan Puryear contributed to this report.