The Paris attacks. A case of intelligence failure?

On November 13th, 2015, a coordinated terrorist attack in Paris killed 130 people and injured 352 others. The attack was carried out by a commando of at least 8 Islamic State terrorists divided in 3 groups, and masterminded by Belgian national Abdelhamid Abaaoud, killed in a raid in Saint-Denis on November 18th. Some of the perpetrators were already known to the authorities as dangerous radicalized individuals, while others were identified foreign fighters with battlefield experience in Syria.

While fear of further attacks remains high, should questions about the skills, resources and coordination of European intelligence agencies be raised?

An intelligence failure?

The Paris attacks are an example of intelligence failure which will require a deeper investigation (post mortem analysis) in coming months. A post mortem report is an evaluation of what went wrong in the intelligence cycle that led the security services not detect a threat or prevent an attack. For what we know so far about the profiles of the attackers, the intelligence failure manifested itself in three areas:

1. Failure in the detection and prioritization of threats;

2. Failure in surveillance;

3. Failure in information-sharing;

1. Failure in the detection and prioritization of threats

French riot police secure the area near the Bataclan concert hall in Paris, France, November 13, 2015. © REUTERS

The most common mistake in the intelligence cycle is not recognizing a threat as such, or not placing it in the right rank of risk priorities. This can happen for two reasons. Firstly, the intelligence apparatus is focusing on specific, already known, threats that tend to reduce their “field of view” on new ones. This means that new threats may not come under the radar of intelligence officers and remain undetected. The second reason occurs when a threat is recognized as potential but it is not evaluated as either imminent or causing a high impact. In the Paris attacks case, both dynamics materialized as some of the attackers were already known to the authorities, while others were not identified as a threat. This leads to the second factor in the intelligence failure.

2. Failure in surveillance

Once the threat is identified, a constant and effective monitoring has to be put in place. France has about 11,000 radicalized individuals, out of which about 1,200 are foreign fighters. Considering that for a 24/7 surveillance of a suspect, a security apparatus needs to deploy at least 15-20 men, France would need about 220,000 officers to monitor its suspects. Certainly not a viable option considered the limited resources.

Blue, white and red brassieres, the colours of the French national flag, hang from a balcony in Marseille, France, November 27, 2015 as the French President called on all French citizens to hang the tricolour national flag from their windows on Friday to pay tribute to the victims of the Paris attacks during a national day of homage. © REUTERS

However, in the Paris attacks case the surveillance of identified threats failed despite existing knowledge and new clues. The Bataclan suicide bombers Ismael Omar Mostefai and Samy Amimour were monitored by the French intelligence since 2010-2012, and it was also known that both have travelled to Syria to fight alongside the Islamic State. The same for the mastermind of the attacks, Abdelhamid Abaaoud. All three foreign fighters known to the authorities were able to escape surveillance and move back and forth between Europe and Syria unnoticed.

Therefore, although they were identified as a threat, the surveillance failed to spot them in the Belgian and French territory. This would have allowed the security services to raise their alert level, and possibly prevent the attacks. According to Turkish authorities, Turkey notified France twice about the presence on its territory of suicide bomber Mostefai in December 2014 and June 2015, but did not receive any feedback from Paris. This leads us to the third area of intelligence failure: information-sharing.

3. Failure in information-sharing

The Paris attacks highlighted an information-sharing problem among several European Union and NATO countries. If the French and Belgian security services are to be blamed for losing track on their suspects, other European countries that have seen these suspects crossing their territory should also bear their share of responsibility. Information-sharing is of paramount importance considering that once within the Schengen zone an individual can freely travel across the continent.

Belgian soldiers and police patrol in central Brussels as police search the area during a continued high level of security following the recent deadly Paris attacks, Belgium, November 24, 2015. © REUTERS

More practically speaking, this means that the known suspects should have been monitored in Syria and put under strict surveillance once they entered Europe again. This implies that EU countries should share a list of suspected extremists, hence allowing partner countries to “reset their radars”, keep track and notify about important information regarding the suspect(s). The intelligence failure between France and Turkey on Mostefai is even more surprising as the two NATO allies have been sharing intelligence for decades in military cooperation.

Lack of resources?

France interior intelligence agency DGSI has approximately 3,300 officers, who are tasked with monitoring 20,000 people on national security watch lists, out of whom 11,000 are identified Islamist extremists. Simply put, the intelligence is extremely overstretched and incapable of coping with the threat.

Security and defence agencies in most of European and NATO countries have suffered conspicuous budget cuts over the past 7 years, as a result of the economic crisis and the consequent implementation of austerity measures. The 9/11attacks in Washington and New York were already too far in the memory of decision makers and public opinion, which led national security to be threatened more by economic factors than terrorism or other forms of hard security threats.

The trend now seems to be reversing one more time. With European economies on a recovery path, albeit a slow one, and with the threat of domestic terrorism on the up, new resources are being made available for intelligence agencies. Following the Paris attacks, President Hollande announced that 8,500 new personnel will be added to the security services.

A French soldier holds his Famas assault riffle as he patrols in front of the Louvre Museum Pyramid's main entrance in Paris, France, as part of France's national security alert system "Sentinelle" after Paris deadly attacks November 27, 2015. © REUTERS

In the UK, the intelligence services personnel will increase up to 15 per cent, with approximately 1,900 new officers. In addition, special troops from the SAS and SBS will be incorporated within Scotland Yard ’s Counter Terror Command. Last but not least, the budget for aviation security will be doubled to 18 million GBP, and additional security measures will be taken to secure aircrafts and airports in North Africa, the Middle East and Asia. This new reassessment in the aviation sector is also driven by the shooting down of Russian Metrojet flight 7K9268 in North Sinai on October 31st by Islamic State-affiliated "Sinai Province" terrorist group.

However, will increasing resources be enough to avoid further attacks on the European soil? The answer is no, and the explanation is twofold. First of all, the effect of this new recruitment will only be noticeable in the medium/long term, as it will take some time for the new personnel to be trained and methodologies to be re-assessed and eventually improved. Secondly, security services are not only limited in terms of resources, but also by the laws regulating the intelligence services in a liberal democracy. This implies a trade-off between security and privacy that in most of the cases ends in favour of the latter.


The November 13th Paris attacks were the third terrorist attack that occurred on the French soil in 2015, following Charlie Hebdo in January and the shooting on-board the Amsterdam-Paris train in August. Therefore, they cannot be considered as a “wake-up” call on the terrorism threat in France, and Europe in general. Rather, the Paris attacks should call for a deep review of European intelligence services, their risk assessment methodologies, and the financial and legal resources at their disposal. Last but not least, this is the last call for the European intelligence community to agree on a more efficient intelligence-sharing framework, which does not necessarily imply the creation of a European Intelligence Agency. If we fail to put a patch on these leaks, the question to be answered will no longer be if another terrorist attack will occur, but when and how bad it will be.

the Author

Edoardo Camilli, CEO at Hozint – Horizon Intelligence