PARIS • Investigators found crates' worth of disposable cellphones, meticulously scoured of e-mail data. All around Paris, they found traces of improved bomb-making materials. And they began piecing together a multi-layered terrorist attack that evaded detection.
In the immediate aftermath of the Paris terror attacks on Nov 13, French investigators came face to face with the reality that they had missed signs that the Islamic State in Iraq and Syria (ISIS) was building the machinery to mount sustained terrorist strikes in Europe.
Now, Friday's arrest in Belgium of Salah Abdeslam, who officials say was the logistics chief for the Paris attacks, offers a crucial opportunity to address the many unanswered questions surrounding how they were planned.
Much of what the authorities know is in a 55-page report compiled in the weeks after the attack by the French anti-terrorism police and presented privately to France's Interior Ministry; a copy was recently obtained by The New York Times.
While much about the Paris attacks has been learnt from witnesses and others, the report has offered new perspectives about the plot that had not yet been publicised.
The documents... suggest that nearly two years of previous, failed attacks overseen by the leader of the Paris assault, Abdelhamid Abaaoud, served as both test runs and initial shots in a new wave of violence ISIS leaders have called for in Western Europe and Britain.
The attackers, sent by ISIS' external operations wing, were well versed in a range of terrorism tactics - such as using suicide vests, having gunmen in various locations and hostage-taking - to hamper the police response, the report shows. They exploited weaknesses in Europe's border controls to slip in and out undetected, and worked with a high-quality forger in Belgium to acquire false documents.
The scale of the network that supported the attacks, which killed 130 people, has also surprised officials. As of yesterday, there are 18 people in detention in six countries on suspicion of assisting the attackers.
The French police report, together with hundreds of pages of interrogation and court records, also obtained by The New York Times, suggest that there are lingering questions about how many others were involved in the terrorist group's network, how many bomb makers were trained and sent from Syria, and the precise encryption and security procedures that allowed the attackers to evade detection during the three months before they struck.
Taken as a whole, the documents, combined with interviews with officials and witnesses, show the arc of ISIS' growth from a group that was widely viewed as incapable of carrying out large-scale terror assaults.
And they suggest that nearly two years of previous, failed attacks overseen by the leader of the Paris assault, Abdelhamid Abaaoud, served as both test runs and initial shots in a new wave of violence ISIS leaders have called for in Western Europe and Britain.
The attackers in Paris appear to have moved easily between Belgium and France and, in some cases, between the Middle East and Europe.
At least three of the Paris attackers were wanted on international arrest warrants before the attacks but were able to travel freely. And security services are constrained by the inability or unwillingness of countries to share intelligence on potential terrorists, for legal, practical and territorial reasons.
"We don't share information," said former French intelligence head Alain Chouet. "We even didn't agree on the translations of people's names that are in Arabic or Cyrillic, so if someone comes into Europe through Estonia or Denmark, maybe that's not how we register them in France or Spain."
According to the police report and interviews with officials, none of the attackers' e-mail or other electronic communications have been found, prompting the authorities to conclude that the group used encryption. What kind of encryption remains unknown, and is among the details that Abdeslam's capture could help reveal.
NEW YORK TIMES