Paris: An Intelligence Failure or a Failure to Understand the Limits of Intelligence?

The 13 November terrorist attacks in Paris were the deadliest attacks by the jihadist movement in Europe in over a decade. Questions are being asked if these attacks represent an intelligence failure on the part of the French services charged with responsibility for counter-terrorism matters. All terrorist attacks, whether partially or completely successful, represent a failure of the state agencies charged with protecting the citizens of that state. But this does not necessarily equate to an intelligence failure, which implies that the intelligence process, or parts of it, did not function. 

An intelligence failure can be analysed in two different ways. The first is to differentiate between strategic and operational warning. The second is to examine the different components of the intelligence process to evaluate whether there were missed opportunities. 

At the strategic level, the French intelligence (DGSE) and security (DGSI) agencies had identified the threat to France from Daesh, Jabhat Al-Nusra (JaN), Al-Qa’ida-affiliated entities active in Yemen and the Sahel, as well as France-based sympathisers of these groups. The strategic environment had been mapped and this can be seen in the efforts to acquire extra resources through financial means as well as increased collection permissions through changes to legislation. Speaking recently in the US, the director of the DGSE was very clear about the nature of the threat facing France. 

At the operational level, authorities are dealing with groups and individuals suspected of planning an attack or of having the capacity to do so. This level is more complex than the strategic level as it requires the identification of particular individuals or groups of individuals involved in specific plotting. The intelligence process is the same: identification, collection, analysis and mitigation. The four areas are complex enough when the target set is limited but even more so when there are potentially thousands of individuals and multiple threat streams – groups in Yemen, Iraq and Syria, Mali, Somalia, and then individuals acting alone or relatively spontaneously.

The collection effort is complex, particularly when dealing with individuals travelling abroad – necessitating co-operation with other states whose interests will not always converge or which may not be able to provide timely or continuous intelligence support. The co-operation problem is acute in foreign-fighter mobilisations, involving multiple agencies in multiple states. Here, the risks of co-operation not being timely enough are increased.

 Daesh’ grip on territory in both Syria and Iraq has added complexity to the problem –  in this instance, fighters and travellers have two possible destinations. Transit is through Turkey, although increasingly via other states, as ‘broken travel’ is used to avoid detection. To complicate matters further, returnees may choose to take a detour via a neighbouring state, rather than returning directly to their state of origin. Here lies intelligence hell: knowing what the problem is, or who the target is, but facing significant difficulties to collect against the target due to co-operation. 

Questions have been asked about why the French authorities did not pay attention to individuals flagged by Turkey, or why another individual who was the subject of surveillance was not arrested. These questions assume that the information provided by liaison partners was detailed, specific and related to planning the Paris attacks. These questions ignore the legal constraints on intelligence and police services – the absence of evidence leads to the discontinuation of surveillance and re-tasking of assets to other individuals assessed to be of higher priority. 

There are reports that the Iraqi intelligence services passed information to the French about an attack, but it is unknown how detailed the information was and whether it was actionable or verifiable. Similarly, the Germans reportedly arrested an Algerian who stated that an attack was imminent; again, it is not indicated whether there was sufficient detail to allow for investigations. The French services likely receive many such intelligence tip-offs requiring evaluation and investigation, but ultimately, there may simply not be sufficient detail to allow for exploitation.

Another problem is the sheer number of such tip-offs. The Turkish authorities are reported to have sent messages to the French authorities about one of the attackers in December 2014 and June 2015. It is unknown what information these notifications contained. But given the number of arrests by the Turkish authorities in the past year, the French authorities will have received hundreds of similar notifications during that time. 

The multinational nature of the group of attackers evidently added a further layer of complication to the intelligence function. A Belgian national involved in the attacks was investigated (and cleared) by the Belgians, having been detained and expelled by the Turkish authorities. It is possible that the Turkish authorities did not notify the French in this instance.  

Then there is the matter of individual error. The police checks on the individuals fleeing Paris are an example of Richard Betts’ innocent enemies of intelligence; cases where individuals, in doing their jobs, make mistakes. Although the car was stopped three times, the individuals were not detained because they were not in the police systems for terrorism. Perhaps a more zealous officer would have, by precaution, taken more interest in the three passengers. 

The totality of the information in the public domain does not yet point to an intelligence failure. It points instead to the difficulties intelligence and security services have in collecting and analysing information, particularly as they are dealing with unprecedented numbers of individuals of concern, not only from France but also from Belgium and elsewhere. The Paris attack points to the difficulties of co-operation between countries as well as of collecting information once individuals have entered Syria. 

Finally, the questions assume that had the French looked at all of this information together, they would have come to the conclusion that a plot was to occur on 13 November in Paris – a case of connecting the dots. However, intelligence services need to know what dots to connect and in which order. It is also possible that even with all of the above information connected, the French authorities may still not have been able to identify the plot. 

As Betts as points out, terrorist networks are not easy targets; they actively avoid detection. Intelligence has limits and sometimes the enemy is able to limit the effectiveness of even the most competent agencies. In these cases, the agencies don’t know what they don’t know until they do – and then it is too late.

Timothy Holman PhD candidate at the S. Rajaratnam School of International Studies (RSIS). He holds a BA (Hons) in Persian and Development Studies from the School of Oriental and African Studies in London and  Master of Letters in Terrorism Studies from the University of St. Andrews in Scotland. He is a former criminal intelligence analyst with INTERPOL, The Swiss Federal Police and The International Criminal Court.