SALZBURG, Austria
On a crisp morning last October, 198 refugees and migrants arrived on the Greek island of Leros, all of them seemingly desperate people seeking sanctuary in Eur-ope. But hiding among them were four men with a very different agenda.
The four were posing as war-weary Syrians — all carrying doctored passports with false identities. And they were on a deadly mission for Daesh.
Two of the four would masquerade as refugees all the way to Paris. There, at 9:20pm on November 13, they would detonate suicide vests near the Stade de France sports complex, fulfilling their part in the worst attack on French soil since the Second World War.
The other two men would not make it that far.
Stopped upon arrival in Greece for lying about their identities, they were delayed — but only for a few weeks before being granted permission to continue their journey deeper into Europe. Their story — including key details never before disclosed — offers a cautionary tale for a continent suddenly facing its worst security threat since the end of the Cold War. The men’s’ journey from the battlefields of Syria was reconstructed through interviews with intelligence officials and from French investigative documents obtained by The Washington Post, as well as an interview with a Daesh commander.
European security officials say they believe that Daesh has seeded terror cells on the continent over the past year and was able to do so in part because the European Union failed to come to grips with a refugee crisis that opened a funnel for the militant group.
Europe is now working with Turkey to bar its doors, ending the waves of irregular migration that washed over the continent last year. But more than a million refugees and migrants — a record — have already entered. Hundreds of thousands of them, European intelligence agencies say, may have done so without thorough checks at their entry point: Greece.
Over the past six months, more than three dozen suspected militants who impersonated refugees have been arrested or died while planning or carrying out acts of terror. They include at least seven directly tied to the bloody attacks in Paris and Brussels.
Daesh is gloating that they have far more lying in wait.
“We have sent many operatives to Europe with the refugees,” a Daesh commander said in an interview over an encrypted data service. “Some of our brothers have fulfilled their mission, but others are still waiting to be activated.”
In early September, just a few weeks before the four men landed on Leros, they were invited to attend a secret meeting in a central Syrian city controlled by Daesh.
Doctored passports
Two of them — the ones who would blow themselves up outside the Stade de France — were later glorified in a Daesh video as unnamed militants from Iraq. The other two men, both round-faced and lightly bearded, were Mohammad Usman, a Pakistani who claims to be 23 years old, and Adel Haddadi, a 28-year-old Algerian.
On the morning of October 3, the four terrorists tried to blend in with the refugees who had come ashore that day.
When their turn came, the two Iraqi militants showed authorities doctored Syrian passports, according to the classified French files obtained by The Post.
Remains of the documents found near their bodies at the Stade de France suggested they had come from a cache of more than 3,800 passports — all authentic — seized by Daesh after its major advances in Syria in 2013.
While the passports had been tampered with to insert new photographs, they otherwise appeared real to the eye and touch.
Classified records show the Iraqis who claimed to be Syrian — and who still have not been identified — then quickly travelled over land to Serbia, where they registered at a refugee camp in Presevo on October 7. By November, they had linked up with the other assailants involved in the Paris attacks.
On November 13, they became the only non-European born attackers to take part in a series of assaults that saw nine men kill 130 people at different locations in Paris. But that day, what was nine assailants might have been 11.
Like the two Iraqis, Usman and Haddadi also produced falsified Syrian documents. But when questioned by Frontex, the two men, unlike the Iraqis, crumbled.
Usman, a Pakistani, did not speak Arabic well — quickly betraying his claim to be Syrian. Haddadi knew almost nothing about the city he said was his birthplace — Aleppo, Syria.
Both men were transferred to the larger Greek island of Kos, where they were given lightening legal judgements. In what became a customary practice in Greece, Usman and Haddadi received suspended three-month sentences along with an order to leave the country within a month.
After gaining their freedom on October 28, Haddadi sent a text via WhatsApp to their Daesh handler in Syria asking for money. That money soon arrived via a wire from Turkey to Greece. The two continued their journey through the western Balkans, passing through Macedonia, Serbia, Croatia and Slovenia to finally arrive in Austria.
On December 4, both men applied for asylum in Austria, and then took up residence in a refugee centre near the German border.
European authorities launched a massive investigation following the Paris attacks, and were beginning to retrace the attackers’ steps. After finding a Syrian passport at the Stade de France, investigators ran fingerprints and discovered that two of the dead men had arrived in Greece as Syrian refugees on October 3. A manifest of the day’s refugee arrivals was run through databases and returned two hits — men also claiming to be Syrian who had arrived that day.
On December 10, Austrian police in Salzburg received their photos and fake Syrian names from French intelligence. Within four hours, they had tracked them down to the refugee centre. A SWAT team moved in, arresting the two men in their room.
During 150 hours of interrogation, both men would tell their stories. They are now being held at an undisclosed jail in Austria, and based on their testimony investigators are pursuing various leads.
“They are sad they did not die with the others in France,” said a European security official.
— Washington Post
