Tactics, Techniques, and Procedures Used in the 13 November 2015 Paris Attacks

“This Joint Intelligence Bulletin (JIB) is intended to provide a review of the tactics, techniques, and procedures demonstrated by the perpetrators of the 13 November 2015 attacks in Paris, France. This JIB does not provide analysis of any follow-on operations or operations occurring in Europe in the wake of the attacks. It relies on a variety of open source and media reporting for the analysis, which could change as official details of the post-incident investigations come to light. This JIB is intended to support the activities of DHS, FBI and NCTC to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private-sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States. Information in this JIB is current as of 23 November 2015.

DHS, FBI and NCTC assess the 13 November near-simultaneous attacks targeting a stadium, multiple restaurants, and a concert hall in Paris—for which Islamic State of Iraq and the Levant (ISIL) has claimed responsibility—demonstrated a greater degree of coordination and use of multiple tactics, resulting in higher casualties than has been seen in any previous ISIL Western attack. The selection of multiple targets and the disciplined approach to each attack indicate the attackers may have had some level of prior training, conducted some level of pre-operational activity, had familiarity with the target sets, and conducted tactical planning to ensure the attacks would be effective.

The attackers,some of whom are assessed by European services to have traveled to Syria, were equipped with assault rifles and explosive-laden suicide belts, and operated in a manner indicative of prior training. The selection of targets, including an approximately 80,000-person capacity stadium hosting a soccer match between the French and German national teams, a concert venue featuring an American rock band, and restaurant districts, indicate they may have used their local insight to select targets. French authorities believe that the attacks were coordinated by now-deceased Belgian national Abdelhamid Abaaoud, who was linked to several other ISIL plots in Belgium and France this year.

At least eight attack operatives divided into three teams attacked seven different locations, murdering at least 130 and wounding at least 352 in less than an hour. Six of the attackers reportedly died after detonating suicide belts and another was reportedly killed by police during a raid; European authorities have issued an international warrant for at least one of the remaining operatives who is believed to be at large and are investigating possible accomplices in multiple European countries.

Stadium Attack: One team of three operatives detonated their suicide belts outside the Stade de France, killing one bystander, based on eyewitness accounts and French government statements. According to unconfirmed accounts, one suicide bomber allegedly tried to enter the France-Germany soccer match and detonated his device after being denied entry to the stadium by security. A second suicide bomber detonated himself outside the stadium, while the third detonated himself outside an American fast food restaurant near the stadium. Details about the sequence of events are still preliminary.

Restaurant Attacks: Two operatives opened fire on patrons of Le Carillon bar and Le Petit Cambodge restaurant in the city’s 10th district, murdering 15 and injuring more than 20. The gunmen then drove to the La Bonn Biere and opened fire, murdering five people before moving onto La Belle Equipe restaurant and killing 19, according to open source reports. One of the operatives detonated a suicide belt on the veranda of the Voltaire restaurant, seriously injuring a restaurant patron. None of these locations were known to have had a security presence.

Concert Hall Attack: Three gunmen wearing suicide belts stormed the Bataclan Hall during a rock concert, took hostages, and reportedly started executing them, resulting in more than 80 deaths and scores of injuries. One of the operatives purposefully detonated his suicide belt, while the final two gunmen were killed in a shoot-out with police. Details on the sequence of events are still preliminary.

Subsequent Activities: French authorities conducted a pre-dawn raid on 18 November at an apartment in a neighborhood near the Stade de France, according to the French interior minister, and received heavy gunfire from the apartment inhabitants.

At least three suspects were killed and seven others were taken into custody. French authorities confirmed the suspected attack coordinator, Abdelhamid Abaaoud,was killed during the raid. The results of the aftermath of this raid are still being investigated by French authorities, including the potential for follow-on attacks. Belgian authorities on 22 and 23 November conducted raids at multiple locations across Belgium, resulting in the arrests of at least a dozen individuals and charges against three persons believed to have been involved in the 13 November attacks.

Recent ISIL Targeting in the West Includes a Diverse Set of Soft Targets, Range of Complexity

We assess ISIL may expand efforts to conduct attacks against soft targets based on the success of the Paris attacks; we are, however, unaware of any intelligence indicating any active, credible ISIL plots of the type seen in Paris targeting the Homeland. We judge ISIL will almost certainly consider a diverse selection of soft targets for attacks in the West—including in the United States—that extend beyond targeting government, military, and law enforcement officials and facilities, based on the target selection in the attacks and other recent plots in the West. Supporters of the group who may be located in the Homeland continue to have the ability to conduct relatively unsophisticated attacks with little to no warning.

Train passengers in late August 2015 overpowered a gunman on an Amsterdam-to-Paris Thalys train as he attempted to conduct a mass shooting and stabbing attack against passengers. The attacker, Moroccan national Ayoub El-Khazzani, had possibly traveled to Syria, according to open source and official government statements.

An alleged ISIL operative arrested in mid-August 2015 told French police that he was ordered by an individual fitting the description of Abaaoud to conduct a mass shooting at an unspecified concert venue in France, according to press reports. The suspect had been in France for two months after returning from a six-day trip to Syria.

French authorities in late April 2015 arrested another alleged ISIL operative—Sid Ahmed Ghlam, who was also linked to Abaaoud—after he accidentally shot himself and called for medical assistance, according to open sources. Police discovered weapons, ammunition, bullet-proof vests, and details about possible attacks against churches in Ghlam’s car. French security services were previously aware of Ghlam’s expressed interest in traveling to Syria.

Belgian authorities raided multiple locations in mid-January 2015, including a safehouse in Verviers, Belgium associated with Abaaoud, and disrupted an ISIL plot involving at least 10 operatives, according to open sources. The plot—possibly targeting the police or the public—featured police uniforms, explosive precursors consistent with the manufacturing of triacetone triperoxide, or TATP, and resulted in the death of two operatives and the arrest of facilitators in multiple countries. Prior to the Paris attack, the Verviers plot illustrated a higher level of operational planning than known ISIL plots against the West.

Attack Indicates Efforts to Maximize Impact of Simple Assault Tactics Through Operational Security and Effective Planning

We assess the three-team coordination and near-simultaneous timing of the attacks suggests the attackers may have had some level of pre-operational surveillance, familiarity with the target sets, and some level of tactical planning to ensure the attacks would be effective. The attackers and operational planners employed a high degree of operational security, which almost certainly aided in their ability to remain under the radar of law enforcement and intelligence services. These factors indicate some of the attackers and planners almost certainly had some level of training, conducted some level of pre-operational activity, and had familiarity with the target sets.

Operational Security: The French government has confirmed some of the operatives were French nationals, some of whom likely had returned from Syria and may have planned the attack from Belgium, giving them opportunities to discuss operational details outside the purview of French security services. The attackers rented three vehicles in Belgium before re-locating to a safehouse in France, possibly in an effort to conceal their movements and obscure the ultimate target locations. French authorities located a cellphone outside the Bataclan concert venue likely belonging to one of the operatives containing encrypted applications, likely intended to make it difficult for security services to exploit the contents. There is limited details on the origin of the firearms or the fabrication of the explosives belts but the cell was either able to build them in Europe without receiving scrutiny by security services or smuggle them across international borders.

Preoperational Surveillance and Coordination: French authorities also claimed the phone linked to the Bataclan cell contained a map of the music venue, indicating the operatives probably familiarized themselves with the layout of the venue and conducted some sort of pre-operational surveillance prior to launching the attack, according to our analysis of open sources. The phone also contained a text message that included the phrase “let’s go, we’re starting,” highlighting phones were the probable method used for coordinating the assault, either at the theater or amongst all the attackers.

Familiarity with Target Sets: Since many of the attackers were French or had spent time residing in Paris, we assess they almost certainly had insight into which areas would be most crowded and at which times. We also assess the attackers likely would have recognized the high-profile nature of the match involving the French national soccer team, which would generate high attendance at the stadium and receive significant television coverage.

Training: The tactical maneuvers observed by witnesses at the Bataclan Theater may be indicative of some level of prior training. Witness reports indicate at least two of the shooters sought a high-ground position, possibly on the second level, which provided an advantageous position to maximize causalities. Witness reports also indicate the operatives maintained a disciplined firing approach;while one operative would reload, another would continue firing to avoid being disrupted and continue the carnage. During the police raid, one of the attackers detonated his suicide belt to potentially avoid being taken into custody or to kill first responders.

For more details, see source document as acquired from Open Sources on the public Internet.

T actics, T echniques, and Procedures Used in the 13 November 2015 Paris Attacks

OODA Analyst

OODA Analyst

OODA is comprised of a unique team of international experts capable of providing advanced intelligence and analysis, strategy and planning support, risk and threat management, training, decision support, crisis response, and security services to global corporations and governments.