The Brussels Attacks – 22/03/2016 What do we know?

Putting things in context: Terrorism in Belgium

On Tuesday, 22 March 2016, Belgium witnessed the worst terrorist attack carried out on its soil. While the full identity of the attackers is still under investigation, Belgium has a history of being the victim of both international and homegrown terrorism.

Belgium is the strategic and diplomatic hub of Europe – home to both the European Union and the North Atlantic Treaty Organization (NATO) headquarters. Its important stature makes the country a figurehead of European and Western values, and therefore a high-value target on both a practical and a symbolic level. An example of this was seen in December 2008 when Belgian security forces carried out raids in Brussels and Liege, arresting fourteen individuals, for a suicide bombing plot against a major European summit and for being members of Al-Qaeda. Four members of the cell were Belgian citizens. Malika El Aroud and Moez Garsallaoui, two well-known radicals in Belgium, recruited the cell. The cell was not only recruited by Belgians, but had members of the cell that were Belgian citizens. If successful the cell could have carried out a mass casualty attack on Belgian soil, against their own country.[1]

The opening of borders between European Union countries has led to increased freedom of movement, which has in turn led to a rise in transnational crime and terrorist activities. Countries in Europe can no longer be solely concerned with their own vulnerabilities, but must also be mindful of the threats posed by operatives who may enter from the surrounding region. High levels of cross-border communication and intelligence-gathering are now crucial to prevent the further perpetration of atrocities on Belgian soil.

In addition, Belgium has the highest number per capita of foreign fighters of any European or Western country. In raw numbers, Belgium has the fourth highest number of foreign fighters in the European Union (estimates range between 450 and 550), behind France, the United Kingdom, and Germany.  Belgium has also witnessed several terrorist attacks on its soil, as well as seen a number of Belgian citizens involved in terrorist acts in other parts of Europe. As such, it is clear that there exists in Belgium terrorist infrastructure affiliated with Global Jihadi ideology.

 Foreign Fighters in Syria/Iraq (2012 to 2014) - per million population

Foreign Fighters in Syria/Iraq (2012 to 2014) – per million population”[2]

Overview of the Attacks

On Tuesday, 22 March 2016, Brussels witnessed two terrorist attacks on its soil; the first attack was carried out at the Brussels Airport, while the second attack hit the Maelbeek subway station, in the European neighborhood of Brussels. The combined attacks killed at least 30 people and injured hundreds.

At 08:12 two explosions hit the #3 and #11 check-in zones of Terminal 3 at Zaventem Airport in Brussels, Belgium. Two suicide bombers, brothers Khalid and Brahim El Bakraoui, detonated their suitcase bombs causing two explosions. According to medical officials, at least 14 people were killed and 106 were injured from the explosions. Like in many suicide attacks, screws were added to the explosive devices to increase the number of fatalities. According to the Belgium prosecutor’s office, an AK-47 and an unexploded suicide belt were found in close proximity to the attacks. A third individual was seen with the bombers and Belgian authorities are currently looking for him.

Map of Terminal 3, Zaventem Airport, Brussels, Belgium

Map of Terminal 3, Zaventem Airport, Brussels, Belgium

At 09:24, a single suicide bomber detonated his explosive belt inside a train car at the Maelbeek subway station, in close proximity to the Parliament of the European Union. According to Belgian officials, more than 20 people were killed and 130 were injured.

 Map of Maelbeek Station, Brussels, Belgium

Map of Maelbeek Station, Brussels, Belgium

According to Belgian media, the two perpetrators of the Zaventem attack were two brothers, Khalid and Brahim El Bakraoui. At least one of them was known for connections to terrorism. The El Bakraoui brothers escaped an apartment in the Forest neighborhood of Brussels a few days prior during a police Raid. Police forces were searching for them for at least a week. In October 2010, Brahim El Bakraoui was charged for shooting policemen with an AK-47.[3]

In terms of the explosives, it has been reported that Triacetone Triperoxide was likely used in the attacks.[4] Triacetone Triperoxide, or TATP, is a highly unstable primary explosive, usually used as a detonator. It should be noted that the use of TATP was discussed on top-tier Jihadi forums, such asShumukh al-Islam, including instructions on how produce and store it.[5]

 The El Bakraoui Brothers (Khalid and Brahim) are suspected of being the suicide attackers who carried out the Zaventem Attacks.

The El Bakraoui Brothers (Khalid and Brahim) are suspected of being the suicide attackers who carried out the Zaventem Attacks.


ISIS released written statements in French and Arabic claiming responsibility for the twin attacks at Brussel’s Zaventem Airport and Maelbeek metro station titled, “Statement on the Blessed Raid in Brussels against Crusader Belgium.”

“(…) a number of soldiers from the Caliphate – carrying explosive belts, bombs and automatic weapons, and targeting locations chosen with precision in the Belgium capital, Brussels – entered Zaventem Airport of Brussels and a subway station in order to kill a high number of crusaders. They then detonated their explosive vests in the middle of a crowd. The outcome of the attacks was 40 dead people and no less than 210 injured people. (…) .”

ISIS further threatened of “darker days” against the «crusader countries» which are allied against the Islamic State.

ISIS claimed responsibility for the Brussels Attacks  ISIS claimed responsibility for the Brussels Attacks

ISIS claimed responsibility for the Brussels Attacks

While the identity of the attackers is yet to be officially revealed, Belgian press released a picture of the three suspects of the Zaventem Airport attacks.

Two suspects were wearing identical dark clothes and gloved left hands, while the third, to their left, dressed in lighter clothing and a hat is suspected of fleeing the airport

Two suspects were wearing identical dark clothes and gloved left hands, while the third, to their left, dressed in lighter clothing and a hat is suspected of fleeing the airport

While two of the attackers of the airport bombing are presumed dead, several hours after the attack, Belgian police began a manhunt for the third suspect from the airport attack.

 Belgian police released a picture of a suspect of the Zaventem Airport attacks Belgian police released a picture of a suspect of the Zaventem Airport attacks

Belgian police released a picture of a suspect of the Zaventem Airport attacks


Governmental Response

Due to the attacks, all public transportations in and around Brussels was halted until 16:00. Police evacuated universities and schools, while workers in office building were ordered to remain in-doors. Air traffic was diverted from Brussels Zaventem Airport to other airports in Europe and Belgium, including Charleroi, Liège and Oostende. Several airports throughout Europe were placed on high alert.

Belgium raised its terrorist level to the highest level, four (out of a scale of four) and the European Union raised the alert level to Orange, which is the highest level. Belgium’s nuclear power plants were placed on high alert and all non-essential staff evacuated.

A number of police searches are currently underway in Brussels, and in a raid on an apartment in the Brussels neighborhood of Schaerbeek, police found an ISIS flag, chemicals, and an explosive device.

In addition, Belgian Prime Minister Charles Michel confirmed an increase in military patrols around Brussels and tighter border control.

Social Media Discourse on the Brussels Attacks

The Jihadi discourse on social media networks concerning the terrorist attacks in Brussels can be characterized as supportive declarations and calls to continue with Jihad on European soil. The discourse was conducted, for example, using hashtags such as “Brussels is burning” (??????_?????#), “The Explosions of Brussels” (#???????_??????), “Europe is Burning Again” (#?????_?????_??_????), “The Attacks on Brussels” (#?????_??????) “The Explosion of Brussels” (#?????_??????) and others.

Islamic State supporters praised the attacks on Twitter and Telegram. For instance, «Sultan Sanjar» (a prolific writer of articles in support of the Islamic State) called for the carrying out simultaneous attacks in several airports across Europe and referred to the tremendous economic damage such attacks cause.  From the Islamic point of view, he stressed the importance of jihad in d?r al-kufr («Abode of Unbelief», a place inhabited by non-Muslims) as the reward for such Jihad is greater.[6]

 A call for simultaneous attacks on European airports

A call for simultaneous attacks on European airports

Members of Jihadi forums also referred to the attacks and pointed out the role Belgium plays in the military coalition against IS, while others mentioned the historic oppression of African Muslims by Belgium in the past.[7] Many Twitter users alluded to the recent airstrikes against Mosul University[8]  and even created the hashtag «Mosul’s Revenge against the Capital of Infidels Brussels».[9]

 "Mosul's Revenge against Brussels" hashtag on Twitter

«Mosul’s Revenge against Brussels» hashtag on Twitter

After the twin attacks, social media was blasted with information, including pictures and videos from the scene of the bombings. Some of the information was not clear, and some users posted fake images and videos from other attacks.

Several social media accounts affiliated with Jihadists broadcasted fake information in an effort to carry out psychological warfare. Examples included claims that bombs were placed in Brussels Free University (ULB) as vengeance for the strike against Mosul University or calls not to dispatch the injured to St. Peter Hospital in Brussels as several bombs were allegedly placed in the hospital.

 Fake Tweets to induce panic in Brussels

Fake Tweets to induce panic in Brussels[10]

Facebook activated its safety check feature for the Brussels Attacks to update friends and family on the social network.[11] Crisis Centers in Belgium requested on Twitter that people use text messages and social media to communicate instead of calling, in order to reduce the usage of the network.[12] In addition, the Telnet Hotspot, which provides Wi-Fi services, opened its services free for use.[13]


Terrorism Threat to Public Transportation

Terrorists target public transportation given their direct psychological impact on people’s short-term motivation to travel,[14] thus, paralyzing almost immediately an entire area or even an entire city and consequently, causing serious economic damage.

Rail stations, in particular, contain two main characteristics that terrorist may perceive as vulnerabilities (1) Large accessibility which creates a security challenges. Subway metros have a variety of entrances, exits, and emergency exits that have minimal security scrutiny. (2) Closed public areas such as subway station have relatively high people density which can cause a larger number of casualties.[15]

Airports within the European Union, must comply with a high level of security standards. However in recent years, several terrorist attacks targeted airports and airplanes. The Zaventem Attack reveals the importance of assigning high level security measures also at the entrance of the terminal, and not focusing solely on the airplanes. In addition, the PKK mortar shell attacks on an Istanbul airport highlights the importance of creating security measures at airport parking lots and in close proximity to the airport.[16]

Insights from ICT Experts

Col. (Res.) Jonathan Fighel, Senior Researcher & Head of the Terrorism Prosecution Desk

It seems that the attacks were only in the final stages of operational preparedness (maturation) and the decision to commit the attacks on 22 March was probably accelerated due to the arrest of Salah Abdeslam in Molenbeek a few days before. Abdeslam was one of the organizers of the Black Friday Paris Attacks. One may thus believe that he did not talk in his initial interrogation after his arrest, and withheld information regarding the Brussel Attacks.

At this stage, it is still unknown what interrogation methods were used during Salah Abdeslam’s interrogation and whether Abdeslam was treated as a “ticking bomb”, a term which does not exist among European Security Services. This question raises the need to examine the formulation of an authorized and legal special set of procedures, to be activated and adapted to  interrogation  situations, where there is a «ticking bomb», when other lives are at stake.

As such, following high-profile future arrests of terror operatives, different services should be integrated into the process of preparation for the arrests and its potential consequences, and to prepare accordingly (e.g. increase security, patrols, evaluation of the threat, issue necessary alerts to the public, etc.).

Once key terrorist figures are arrested (and prior to that arrest being made public), friendly intelligence agencies need to be updated in order to execute extra vigilance for possible reactions and to request the sharing of relevant intelligence.

It would seem that today’s attacks, as with other recent attack in Europe, were organized from outside Europe. This fact requires enhanced intelligence coverage against these individuals, most likely located in the Middle East (Syria, Iraq) and the sharing of information with relevant countries.

Mr. Shmuel Sasson, Associate, ICT & Former Director of Security, El Al Airlines

“The attack against Zaventem Airport emphasized the vulnerability of public areas of airports, which are usually closed halls, crowded with people. This can significantly increase the damage caused by the explosion, as luggage and packages are not checked at this stage. One may draw a parallel to the 2011 Moscow Airport Attack. Security checks outside the airport are not the answer, as it will create a new vulnerability by the long lines that these checks will create at the entrance of airport”

Prof. Boaz Ganor, Founder & Executive Director, ICT & Dean of the Lauder School of Government, Diplomacy & Strategy, IDC Herzliya[17]

Organized attacks by terrorist groups, contrary to independent initiatives of lone wolves, are the most lethal and take the biggest toll of casualties. In attacks of this kind, there are also many more accomplices involved in the secret operations, including activists who initiated the attack, planned it, laid the groundwork for the operation, trained the terrorists and, of course, those who actually carried out the attacks. These attacks, therefore, allow intelligence agents a theoretical ability to infiltrate and thwart attacks more effectively than in the case of the lone wolf. With this in mind, the Belgian security services in particular and the Europeans in general must carry out a thorough self-examination to discover how an attack of this scale went unnoticed beneath their radar. Belgium must develop better intelligence capabilities alongside a more effective doctrine to cope with terrorism.

An effective ability to cope with terror requires a deeper understanding of the rationale behind the terrorists’ actions, such as their cost-benefit considerations, and their motives (while distinguishing between “root ideological motivations” and “instrumental motivations”) in concretely executing their attacks. An analysis must be made of the operational abilities of terrorist organizations – its methods of action, recruitment and training, the kinds of attacks it is capable of executing, its physical, human and operational infrastructure, its deployment, its psychological warfare doctrines, and more. At the same time, a country coping with terror must take into account the “democratic dilemma” emerging from the need to maximize the effectiveness of the war against terror while preserving its own liberal democratic values.

Belgium and Europe must now develop the appropriate legislation to grant the essential prerogative of security services to effectively combat terror, while at the same time preserving the necessary proportionality in their actions. In this context, Europe and Belgium should reconsider and reassess their policies on foreign migrants, their border control of migrants entering their countries, and their agreements to allow free travel from one country in Europe to another.

Europe has to develop new ways of advancing multicultural integration, so that only those migrants who are ready to declaratively accept the liberal democratic values of a European state will be granted citizenship.

European states must reassess the threats and their vulnerability to terrorist attacks by using advanced analytical methodology and war games. They must establish new counter-terror units and upgrade the abilities of the existing ones to provide an effective response to complex, multi-locational, integrated and simultaneous terrorist attacks.

They must allocate the necessary funding to fight terror effectively and they must improve their intelligence infiltrations by strengthening their HUMINT (human intelligence), COMINT (communication intelligence) and OSINT (open sources intelligence) capabilities with a special emphasis on social media.

A balance must be achieved between countering the operational abilities of terrorist organizations via a continuous operational battle involving targeted killings of terrorists, arrests of terrorists, harming their military and operational infrastructure, and drying out their financial sources, among other things, while at the same time dealing with the motivations and motives for terrorism. This must all be pursued while acknowledging the current contradiction between the two, which finds expression in the phrase, “the boomerang effect” – the success of the state battle against terrorist organizations raises their desire for revenge.

In addition, a balance must be found between the need to call a spade a spade, and recognizing that the common denominator in most of the terrorists carrying out such attacks is their similar political-religious, Islamist-jihadist worldview. These terrorists are trying to impose their radical interpretation of Islam aimed at imposing their views of religious Islam on the whole world, and they are ready to do so by conducting terror attacks. It must be recognized that such terror attacks are aimed at advancing the establishment of both local and global Islamist caliphates that would operate under Sharia Law. But while addressing these understandings, the fact that these dangerous terrorists and their supporters hardly represent a small minority within the Muslim world cannot be ignored, and therefore, there is a danger of throwing out the baby with the bathwater by not equating Islam and Muslims with these dangerous extremist terrorists. Thus, it is essential that governments not take an ostrich approach combining lip service and political correctness with appeasement to the Muslim world while disregarding the extremist Islamist component of the phenomenon – the public. Indeed, one must avoid an Islamophobic response that ignores the fact that we are talking about a very small minority in the Muslim world, as dangerous as it is, that is seeking to impose its extremist views on the entire Muslim world through its radical interpretation of Islam.

Many Western decision-makers don’t understand how much these fragile balances need to be taken into consideration while contending with terrorism, and therefore they are failing to establish much needed effective counter terrorism doctrines. Decision-makers must recognize the fact that you do not thwart terrorist attacks by promoting your values, but by neutralizing their motivating forces through a nonstop battle against those who carry out terrorist attacks, and their backers. However, this battle must be waged while preserving the liberal democratic values of the western world.

European countries and other countries worldwide must improve the cooperation between their internal intelligence and security agencies, and the international collaboration between these agencies and all the other bodies occupied with coping with global terror. An alternative retribution policy must be formulated – one which provides a solution to the radicalization processes occurring with the prisons themselves. Countries around the world cannot wait until terror attacks occur, and their policies must be proactive in order to prevent attacks before they are carried out. This obligates the countries to take action at the points of origin, training, and activities of the terror organizations in Middle East countries, Syria, Iraq, North Asian countries, and other countries. The terror organizations cannot be permitted to instill fear with their threats, and in that context it is forbidden to adopt dangerous isolationist policies.

To reiterate: the most effective way to fight terror is through the art of finding the right balance – of moving towards a balance between effective counter terrorism and a country’s liberal-democratic values.

The apparent trend in the Western world leans towards transferring the focus from counter terrorism to Countering Violent Extremism (CVE). This trend which is intended «not to provoke», not to cause any alienation among the Muslims is extremely dangerous. True cooperation with the Muslim world in the struggle against Islamic-jihadist terrorists is crucial and is a lofty goal. But the discourse with the moderate majority in the Muslim world cannot start from a point of self-deprecation. It should be instead wise and courageous, and should be based upon a shared understanding that there is no problem with the Islamic religion, but that there is a serious problem today within the Islamic religion. A problem that gives birth to unprecedented terror, political violence, and atrocities. The moderate Muslim majority must wake up and speak out against the resonant and menacing minority that is snatching their religion out from under their feet. For if they don’t act now, they will be the ones who will ultimately pay the price of Islamophobia. This is not a matter of a favor that the Muslims owe to the Western world. They need to save their own religion – Islam – from the jihadist Islamists. The concept of CVE is by definition working against this goal. Furthermore, it is easier for the moderate Muslim to identify with a struggle against terror than a struggle against violent extremists. Furthermore, the problem does not lie necessarily with any specific terror organization such as the Islamic State or Al-Qaeda, or any other jihadist organizations. The problem is with the dangerous political-religious ideology which is expressed through a specific type of political violence – terrorism. This ideology was adopted in the past by Al-Qaeda, and today mainly the Islamic State is promoting it. Even if tomorrow the world succeeded in eliminating those organizations, the ideology – if not dealt with correctly – would live on with the establishment of other organizations who would strive to force a Caliphate state on the entire world by means of terror attacks.

Appendix – Selected Terrorist Incidents Directed at Belgium since 2001

13 September 2001, Kleine Brogel

Nizar Trabelsi, was arrested and convicted for plotting to attack the Kleine Brogel air base in Belgium where American military personnel were stationed. Trabelsi revealed that he had met with Osama Bin Laden several times, and was ordered directly by al-Qaeda to explode a truck bomb at the air base. Trabelsi, a Tunisian citizen and former professional soccer player, served a 12 year sentence in Belgium and was recently extradited to the United States on charges of conspiracy to kill American nationals outside of the United States, conspiracy and attempt to use weapons of mass destruction, conspiracy to provide material support and resources to a foreign terrorist organization, and providing material support and resources to a foreign terrorist organization. Charges regarding reference to weapons of mass destruction result from NATO releasing information that the Kleine Brogel air base is a storage site for nuclear missiles.

19 December 2001

Police arrested Tunisian-born Belgian citizen Tarek Maaroufi, and charged him with recruiting individuals to al-Qaeda. Maaroufi took part in a passport forgery ring, which created fake Belgian passports for al-Qaeda linked terrorists. Maaroufi was also wanted for his ties to terrorist cells in Italy and Germany. He was originally arrested in 1995 and given a three year sentence for being a member of Algerian Armed Islamic Group. In addition, it was charged that Maaroufi met with Eddin Barakat Yarkas, the head of an al-Qaeda cell in Spain.

20–21 April 2002, Charleroi

Machine gun fire against the synagogue in Charleroi, Belgium caused damage but no casualties. No claim for responsibility was made.

3 June 2003, Charleroi

Belgian Police arrested a man of Moroccan origin suspected of preparing a car-bomb attack on the Charleroi synagogue. The car, containing gas canisters, caught fire but did not explode, thereby reducing the risk of substantial damage.

2005, Belgium
In 2005, Saber Mohammed, an Iraqi citizen, was convicted of terrorism-related charges. Mohammed admitted to being the link between al-Qaeda Central and cells in Belgium. In 2000 he was given two cell phones in a Belgian mosque, and asked to answer the phones and serve as a human voicemail, passing the messages on to Moussa Zemmouri and Driss Elatellah. Three months prior to11 September 2001, Mohammed spoke three times with Khalid Sheikh Mohammed.

December 2008, Brussels and Liege

In a December 2008 raid by Belgian security forces carried out in Brussels and Liege, fourteen individuals were arrested for plotting the suicide bombing of a major European summit and for being part of al-Qaeda. Three members of the cell had just returned from Afghanistan and Pakistan, including the suicide bomber himself, and four members of the cell were Belgian citizens. Authorities broke up the cell after an email from one of the cell members was intercepted by the NSA, in which stated he was about to launch a suicide attack. The cell had been recruited by Malika El Aroud and Moez Garsallaoui, two well-known radicals in Belgium. At the trial it emerged that one of the cell members had made a video in which he said goodbye to his family and friends.

23 November 2010, Antwerp

Police arrested a group of jihadists in Belgium suspected of planning terrorist attacks targeting Jews and NATO vehicles in Belgium. The arrests were part of a wider investigation into the financing of a Chechen terrorist network, involving arrests in several other countries.

21 March 2013, Belgium

Hakim Benladghem, 39, was killed by police after a highway chase and shoot-out. A French citizen of Algerian descent, Benladghem was known to have received training as a paratrooper with the French Foreign Legion. Benladghem was suspected of involvement in the armed robbery of a restaurant in Anderlecht, which was carried out with the aim of stealing numerous weapons belonging to the restaurant’s owner. A search of his apartment revealed several weapons, including an assault rifle, a sub-machine gun and a tactical shotgun, as well as tactical equipment, including a ballistic vest, a Kevlar helmet, a ballistic shield and two gas masks. A woman living at the address, believed to be his partner, was arrested and charged with possessing the weapons. Benladghem made several attempts to travel to Israel to fight in Gaza but was refused entry. Records show he received 150 calls to two cell phones from Gaza in February 2008. He also frequently traveled abroad, including trips to Norway, Italy, Switzerland and Syria.

24 May, 2014, Brussels, Belgium

Mehdi Nemmouche shot four people in the Jewish Museum of Brussels in the heart of the city. He was arrested six days later in the train station of Marseilles, in the South of France.

21 August, 2015

On board of a Thalys train from Amsterdam to Paris, Ayoub El-Khazzani, a Moroccan living in Molenbeek, Belgium tried to commit a shooting in the train. He boarded the train in Brussels and was neutralized on board by US military personnel in holidays.

21 to 26 of November 2015

Brussels is put under high alert a few days after the Black Friday Paris Attacks. Following «a serious and imminent» threat, Belgium closed its schools, public transportation and military personnel patrol the city.

18 March 2016

Salah Abdeslam, one of the organizers of the Paris Black Friday Attacks on November 13, 2015 was arrested following a shooting in Molenbeek.

[17] First published and adapted from, Boaz Ganor, “What can be learned from Paris’s black Friday the 13th”, The Jerusalem Post, Sunday 15, 2015 –