Isis has trained at least 400 fighters to target Europe in deadly waves of attacks, deploying interlocking terror cells like the ones that struck Brussels and Paris with orders to choose the time, place and method for maximum carnage, AP has learned.
The network of agile and semi-autonomous cells shows the reach of the extremist group in Europe even as it loses ground in Syria and Iraq.
Officials, including European and Iraqi intelligence officials and a French MP who follows the jihadi networks, described camps in Syria, Iraq and possibly the former Soviet bloc where attackers are trained to attack the West.
Before being killed in a police raid, the ringleader of the November Paris attacks claimed to have entered Europe in a multinational group of 90 fighters, who scattered "more or less everywhere".
But the biggest break yet in the Paris attacks investigation - the arrest on Saturday NZT of fugitive Salah Abdeslam- did not thwart the multipronged attack just four days later on the Belgian capital's airport and metro that left 31 people dead and an estimated 270 wounded.
Three suicide bombers also died.
Just as in Paris, Belgian authorities were searching for at least one fugitive in the attacks - this time for a man seen on security footage in the airport with the two suicide attackers.
The fear is that the man, whose identity Belgian officials say is not known, will find Abdeslam's path instructive.
After fleeing Paris immediately after the November attacks, Abdeslam forged a new network back in his childhood neighbourhood of Molenbeek, long known as a haven for jihadis, and renewed plotting, according to Belgian Foreign Minister Didier Reynders.
"Not only did he drop out of sight, but he did so to organise another attack, with accomplices everywhere. With suicide belts. Two attacks organised just like in Paris. And his arrest, since they knew he was going to talk, it was a response: So what if he was arrested? 'We'll show you that it doesn't change a thing,"' said French Senator Nathalie Goulet, co-head of a commission tracking jihadi networks.
Estimates range from 400 to 600 Isis (Islamic State) fighters trained specifically for external attacks, according to the officials, including Goulet.
Some 5000 Europeans have gone to Syria.
"The reality is that if we knew exactly how many there were, it wouldn't be happening," she said.
Two of the suicide bombers in Tuesday's attacks, brothers Ibrahim and Khalid El Bakraoui, had no known extremist links until an apartment one of them rented was traced to Abdeslam last week, according to Belgian state broadcaster RTBF.
Similarly, an Algerian killed inside that apartment on March 16 had nothing but a petty theft record in Sweden - but he'd signed up as an Isis suicide bomber for the group in 2014 and returned to Europe as part of the November 14 plot.
In claiming responsibility, Isis described a "secret cell of soldiers" dispatched to Brussels for the purpose.
The shadowy cells were confirmed by Europol - the EU police agency which said in a late January report that intelligence officials believed the group had "developed an external action command trained for special forces-style attacks."
French speakers with links to North Africa, France and Belgium appear to be leading the units and are responsible for developing attack strategies in Europe, said a European security official.
He is also familiar with interrogations of former fighters who have returned to Europe. Some were jailed after leaving Isis while others were kicked out of the terror group. The fighters include Muslims and Muslim converts from all across Europe.
Fighters in the units are trained in battleground strategies, explosives, surveillance techniques and counter surveillance, the security official said.
"The difference is that in 2014, some of these Isis fighters were only being given a couple weeks of training," he said.
"Now the strategy has changed. Special units have been set up. The training is longer. And the objective appears to no longer be killing as many people as possible but rather to have as many terror operations as possible, so the enemy is forced to spend more money or more in manpower. It's more about the rhythm of terror operations now."
Similar methods had been developed by al-Qaeda but Isis has taken it to a new level, he said.
Another difference with these "external operation" units is that fighters are being trained to be their own operators - not necessarily to be beholden to specific orders from the Isis stronghold in Raqqa, Syria or elsewhere.
In the case of Tuesday's attacks, Abdeslam's arrest may have been a trigger for a plot that was already far along.
"This was not put together as a response to the arrest. However the timing of what has happened over the last few days has maybe hurried up the planning and execution," said Magnus Ranstorp, a Swedish security analyst. "I see the link to the environments either in France or in Belgium. Whether they're logistically linked ... they're probably part of the same batch of extremists that have come out of Syria."
Several security officials have said there is growing evidence to suggest the bulk of the training is taking place in Syria, Libya and elsewhere in North Africa.
"To pull off an attack of this sophistication, you need training, planning, materials and a landscape," said Shiraz Maher, a senior research fellow at the International Centre for the Study of Radicalisation in London.
Maher has conducted extensive interviews with foreign fighters. The research centre, based at Kings College in London, has one of the largest databases of fighters and their networks.
"Even if they worked flat out, the attackers in Brussels would have needed at least four days," Maher said.
The objective appears to no longer be killing as many people as possible but rather to have as many terror operations as possible
The question for many intelligence and security officials is now turning to just how many more fighters have been trained and are ready for more attacks.
A senior Iraqi intelligence official who was not authorised to speak publicly said people from the cell that carried out the Paris attacks are scattered across Germany, Britain, Italy, Denmark and Sweden. Recently, a new group crossed in from Turkey, the official said.
The latest new name to surface this week, Najim Laachraoui, turned out to be a Brussels resident with a degree in mechanical engineering - the bombmaker who made the suicide vests used in the Paris attacks, according to French and Belgian officials.
De Standaard newspaper, citing an unidentified source, named Laachraoui as the second suicide bomber at the airport.
Attackers used an explosive known as Triacetone Triperoxide, or TATP, made from common household chemicals. Fifteen kilos of TATP were found in an apartment linked to the Brussels attackers, along with other explosive material.
An unidentified man seen wearing a white jersey at the Brussels airport on Tuesday, remains at large, a fugitive link in a chain still being forged.
