The day he left Syria with instructions to carry out a terrorist attack in France, Reda Hame, 29, a computer technician from Paris, had been a member of the Islamic State for just over a week.

His French passport and his background in information technology made him an ideal recruit for a rapidly expanding group within ISIS that was dedicated to terrorizing Europe. Over just a few days, he was rushed to a park, shown how to fire an assault rifle, handed a grenade and told to hurl it at a human silhouette. His accelerated course included how to use an encryption program called TrueCrypt, the first step in a process intended to mask communications with his ISIS handler back in Syria.

The handler, code-named Dad, drove Hame to the Turkish border and sent him off with advice to pick an easy target, shoot as many civilians as possible and hold hostages until the security forces made a martyr of him.

“Be brave,” Dad said, embracing him.

Hame was sent out by a body inside the Islamic State that was obsessed with striking Europe for at least two years before the deadly assaults in Paris last November and in Brussels this month. In that time, the group dispatched a string of operatives trained in Syria, aiming to carry out small attacks meant to test and stretch Europe’s security apparatus even as the most deadly assaults were in the works, according to court proceedings, interrogation transcripts and records of European wiretaps obtained by The New York Times.

Officials now say the signs of this focused terrorist machine were readable in Europe as far back as early 2014. Yet local authorities repeatedly discounted each successive plot, describing them as isolated or random acts, the connection to the Islamic State either overlooked or played down.

“This didn’t all of a sudden pop up in the last six months,” said Michael T. Flynn, a retired Army lieutenant general who ran the Defense Intelligence Agency from 2012 to 2014. “They have been contemplating external attacks ever since the group moved into Syria in 2012.”

Hame was arrested in Paris last August, before he could strike, one of at least 21 trained operatives who succeeded in slipping back into Europe. Their interrogation records offer a window into the origins and evolution of an Islamic State branch responsible for killing hundreds of people in Paris, Brussels and beyond.

European officials now know that Dad, Hame’s handler, was none other than Abdelhamid Abaaoud, the Belgian operative who selected and trained fighters for plots in Europe and who returned himself to oversee the Paris attack, the deadliest terrorist strike on European soil in over a decade.

The people in Abaaoud’s external operations branch were also behind the Brussels attacks, as well as a foiled attack in a suburb of Paris last week, and others are urgently being sought, Belgian and French officials say.

“It’s a factory over there,” Hame warned his interlocutors from France’s intelligence service after his arrest. “They are doing everything possible to strike France, or else Europe.”

Missing the connections

For much of 2012 and 2013, the jihadi group that eventually became the Islamic State, also known as ISIS or ISIL, was putting down roots in Syria. Even as the group began aggressively recruiting foreigners, especially Europeans, policymakers in the United States and Europe continued to see it as a lower-profile branch of al-Qaida that was mostly interested in gaining and governing territory.

One of the first clues that the Islamic State was getting into the business of international terrorism came at 12:10 p.m. on Jan. 3, 2014, when the Greek police pulled over a taxi in the town of Orestiada, less than four miles from the Turkish border. Inside was a 23-year-old French citizen named Ibrahim Boudina, who was returning from Syria. In his luggage, the officers found 1,500 euros, or almost $1,700, and a French document titled “How to Make Artisanal Bombs in the Name of Allah.”

But there was no warrant for his arrest in Europe, so the Greeks let him go, according to court records detailing the French investigation.

Boudina was already on France’s watch list, part of a cell of 22 men radicalized at a mosque in the resort city of Cannes. When French officials were notified about the Greek traffic stop, they were already wiretapping his friends and relatives. Several weeks later, Boudina’s mother received a call from a number in Syria. Before hanging up, the unknown caller informed her that her son had been “sent on a mission,” according to a partial transcript of the call.

The police set up a perimeter around the family’s apartment near Cannes, arresting Boudina on Feb. 11, 2014.

In a utility closet in the same building, they found three Red Bull soda cans filled with 600 grams of TATP, the temperamental peroxide-based explosive that would later be used to deadly effect in Paris and Brussels.

It was not until nearly two years later, on Page 278 of a 359-page sealed court filing, that investigators revealed an important detail: Boudina’s Facebook chats placed him in Syria in late 2013, at the scene of a major battle fought by a group calling itself the “Islamic State in Iraq and Syria.”

According to a brief by France’s domestic intelligence agency, he was the first European citizen known to have traveled to Syria, joined the Islamic State and returned with the aim of committing terrorism. Yet his ties to the group were buried in French paperwork and went unconnected to later cases.

Including Boudina, at least 21 fighters trained by the Islamic State in Syria have been dispatched back to Europe with the intention of causing mass murder, according to a Times count based on records from France’s domestic intelligence agency. The fighters arrived in a steady trickle, returning alone or in pairs at the rate of one every two to three months throughout 2014 and the first part of 2015.

Like the killers in Paris and Brussels, all these earlier operatives were French speakers — mostly French and Belgian citizens, alongside a handful of immigrants from former French colonies, including Morocco.

They were arrested in Italy, Spain, Belgium, France, Greece, Turkey and Lebanon with plans to attack Jewish businesses, police stations and a carnival parade. They attempted to open fire on packed train cars and on church congregations. In their possession were box cutters and automatic weapons, walkie-talkies and disposable cellphones, as well as the chemicals to make TATP.

Most of them failed. And in each instance, officials failed to catch — or at least to flag to colleagues — the men’s ties to the nascent Islamic State.

In one of the highest-profile instances, Mehdi Nemmouche returned from Syria via Frankfurt, Germany, and made his way by car to Brussels, where on May 24, 2014, he opened fire inside the Jewish Museum of Belgium, killing four people. Even when the police found a video in his possession, in which he claims responsibility for the attack next to a flag bearing the words “Islamic State of Iraq and Syria,” Belgium’s deputy prosecutor, Ine Van Wymersch, dismissed any connection.

“He probably acted alone,” she told reporters at the time.

Though the degree to which the operatives were being directed by the Islamic State might have been unclear at first, a name began to appear in each successive investigation: Abdelhamid Abaaoud, a Belgian citizen who counterterrorism officials say rose through the ranks to become a lieutenant of the Islamic State’s external operations efforts.

In the months before the Jewish museum attack, Nemmouche’s phone records reveal that he made a 24-minute call to Abaaoud, according to a 55-page report by the French National Police’s anti-terror unit in the aftermath of the Paris attacks.

“All of the signals were there,” said Michael S. Smith II, a counterterrorism analyst whose firm, Kronos Advisory, began briefing the United States government in 2013 on ISIS aspirations to strike Europe. “For anyone paying attention, these signals became deafening by mid-2014.”

It was in the summer of 2014 that the link to the terrorist organization’s hierarchy became explicit.

On June 22 that year, Faiz Bouchrane, 24, a French citizen who had trained in Syria, was smuggled into neighboring Lebanon. He was planning to blow himself up at a Shiite target, and during interrogation, he let slip the name of the man who had ordered him to carry out the operation: Abu Muhammad al-Adnani.

Al-Adnani is the spokesman for ISIS and is considered one of its most senior members. Just a few days after Bouchrane checked into a budget hotel in Beirut, al-Adnani released an audio recording announcing the establishment of the caliphate.

“Adnani reportedly leads the external operations planning of the Islamic State,” said Matthew G. Olsen, the former director of the National Counterterrorism Center.

Intelligence officials in the United States and Europe have confirmed the broad outlines of the external operations unit: It is a distinct body inside ISIS, with its command-and-control structure answering to al-Adnani, who reports to Abu Bakr al-Baghdadi, the self-proclaimed caliph of the Islamic State.

The unit identifies recruits, provides training, hands out cash and arranges for the delivery of weapons once fighters are in position. Although the unit’s main focus has been Europe, external attacks directed by ISIS or those acting in its name have been even more deadly beyond Europe’s shores. At least 650 people have been killed in the group’s attacks on sites popular with Westerners, including in Turkey, Egypt and Tunisia, according to a Times analysis.

Within the hierarchy, Abaaoud was specifically tasked with mounting attacks in Europe, according to the French police report and intelligence brief.

“Abaaoud, known as Abou Omar, was the principal commander of future attacks in Europe,” Nicolas Moreau, a French jihadi who was arrested last year, told his French interrogators, according to the report by France’s anti-terror police. “He was in charge of vetting the applications of future candidates.”

Pacing attacks

In an audio recording released on Sept. 22, 2014, al-Adnani, the ISIS spokesman and chief of the external operations wing, addressed the West.

“We will strike you in your homeland,” he promised, calling on Muslims everywhere to kill Europeans, “especially the spiteful and filthy French.” And he urged them to do it in any manner they could: “Smash his head with a rock, or slaughter him with a knife, or run him over with your car,” he said, according to a translation provided by the SITE Intelligence Group, which monitors extremist propaganda.

In the months that followed, a man decapitated his employer near the French city of Lyon, sending a snapshot of the severed head to the Islamic State. Another man stormed a police station in Paris, carrying a butcher’s knife and a photocopy of the Islamic State’s flag.

These are among around two dozen plots linked to the Islamic State that were documented in the year after al-Adnani’s speech. In most, there were no direct operational ties back to Syria, but there were clear signs that the attacker had consumed the terrorist group’s propaganda online.

The low potency of these attacks, with single-digit death tolls, combined with the fact that many of the perpetrators had a history of mental illness, prompted analysts and officials to conclude that the Islamic State remained a distant second to al-Qaida in its ability to carry out attacks on Western soil.

Experts now believe that the Islamic State was actually adopting a strategy first put forward by an earlier operations leader for al-Qaida, who argued that the group would become obsolete if it worked only on 9/11-size plots that took months or years to mount. He instead called for al-Qaida to also carry out a patter of small- and medium-size plots, and to use propaganda to inspire self-directed attacks by supporters overseas.

In a recent issue of its online magazine in French, Dar al-Islam, the Islamic State explained the approach. “The Islamic State has deployed its resources to generate three types of terrorist attacks,” the article states, specifying that they include large-scale plots coordinated by the group’s leaders, down to “isolated actions of self-radicalized people, who have absolutely no direct contact with ISIS, and yet who will consciously act in its name.”

The same article says the group’s method for carrying out jihad in Europe involves an adaptation of Auftragstaktik, a combat doctrine within the German army in the 19th century. Those tactical guidelines call for commanders to give subordinates a goal and a time frame in which to accomplish it, but otherwise to give them the freedom to execute it.

The Islamic State explains in the article that it adopted the system to give recruits “complete tactical autonomy,” with few fingerprints that could be tracked back to the group, and “no micromanaging.”

The recruit pipeline

By early 2015, the Islamic State’s external operations branch had personnel dedicated to spending their days in Internet cafes in Syria pumping out propaganda, aimed both at inciting lone-wolf attacks and at luring new recruits.

Among the people who took the bait was Reda Hame, the young technology professional from Paris, who later told investigators that he had joined in hope of fighting to bring down President Bashar Assad of Syria. Instead, upon arriving in Syria in June 2015, he walked directly into the Islamic State’s pipeline for foreign attacks.

During his intake interview in Raqqa, Syria, in June 2015, the Islamic State administrator taking notes on a computer across from him expressed satisfaction when he learned that Hame was from Paris and had a background in technology, according to his lengthy account to France’s domestic intelligence agency, the Direction Generale de la Securite Interieure, or DGSI. The details were recorded in more than 16 hours of questioning, according to a transcript obtained by The Times and first reported on by the French newspaper Le Monde.

Days later, a man wearing a mask called Hame outside, told him to lie down in the bed of a pickup truck, and covered him with a tarp. He was warned to keep his eyes lowered and to not look out.

They drove at high speed, and when the truck stopped, a fighter speaking Arabic directed him to a sport utility vehicle idling nearby, its tinted windows obscuring its occupants. When Hame opened the door to the back seat, the driver said, “Monte devant,” French for “Get in the front.”

The driver, Hame said, was Abaaoud, by then considered the most wanted terrorist in Europe. As they drove through the Syrian countryside, the future architect of the Paris attacks explained to Hame that if he faced the enemies of Islam alone, he would receive double the reward in heaven.

“He asked me if I was interested in going abroad,” Hame told investigators. “He said to imagine a rock concert in a European country — if you were given a weapon, would you be ready to open fire on the crowd?”

When Hame reiterated that he wanted to fight the Assad government instead, Abaaoud became terse. “He said he would show me those wounded in the war and buildings that had been destroyed, so that I would realize how lucky I was to be sent back to France rather than stay to fight here,” Hame recounted.

Videos released by the Islamic State after the Paris attacks in November included footage of eight of the 10 attackers while they were still in territory the terrorist group controlled in Iraq and Syria. They announced that they were acting on the orders of Abu Bakr al-Baghdadi, the caliph of the Islamic State, and then proceeded to shoot or behead a captive, most of them in grotesquely choreographed scenes shot against a desert backdrop, according to the footage archived by the SITE Intelligence Group.

Officials have deduced the footage was filmed between February and September 2015, suggesting the Paris attacks were being planned months before they took place. It is now known that at the same time Abaaoud was laying the groundwork for the devastating plot, he was recruiting, cajoling and training Hame and others for smaller, quick-hit attacks.

The night they met, Abaaoud dropped off Hame at a house in Raqqa with a white gate, according to the transcript. He said he would come for Hame the next morning, and warned him that if he did not agree to the mission, his passport, which was about to expire, would be given to another recruit who would go to Europe in his place.

When Abaaoud returned the next day, his face was covered with a brown scarf with slits for his eyes. He wore a holstered handgun. “He told me that he was now going to explain the mission to me,” Hame said after his arrest, describing how the discussion occurred in the senior operative’s speeding vehicle. “He told me I didn’t have a lot of time; he said he was just waiting for the confirmation of his emir. I told him that I would go.”

Accelerated training

Hame said his training began about a 30-minute drive from Raqqa, in a villa that acted as Abaaoud’s classroom. There, the senior operative demonstrated how to load a Kalashnikov rifle. When Hame tried, he jammed his thumb in the metal, hurting himself. Abaaoud made him repeat the exercise again and again.

The next day, Abaaoud drove Hame to a park covered in dry grass for target practice. Throughout the lesson, Abaaoud repeatedly lost his temper, annoyed by his recruit’s lack of skill.

“He yelled at me because when I was shooting in volleys, it went into the air,” Hame recounted. “He made me practice a lot, to the point that the grass caught fire.”

The instructor appeared even more on edge during the third and final day of Hame’s military training, when he drew a silhouette on the wall of an abandoned building and demonstrated how to throw a grenade. Inexperienced and struggling in the suffocating heat, Hame did not throw it far enough and was cut by shrapnel. Only when Abaaoud saw him bleeding did he relent, driving his student to a nearby clinic to be bandaged.

At night, Hame was dropped off at an apartment in Raqqa that appeared to be a dormitory for members of the external operations branch. One room served as an arsenal, with stacks of suicide belts, jugs of explosives, body armor and combat boots. The other recruits were also French speakers, including a man who said he had been training for eight months. He and Hame were told to team up by Abaaoud, who decided to send them back to Europe the same day.

They were among the many pawns that Abaaoud was positioning across the Continent.

If Hame was not handy with weapons, he had other qualities that were attractive to the Islamic State: He had a French passport, and had worked as a computer technician for Astrium, a subsidiary of the French aeronautics giant Airbus. It was at least the second time that Abaaoud had chosen a fighter with information technology credentials: Sid Ahmed Ghlam, who was dispatched last April to attack churches in France, was in the second year of a five-year computer science program, according to news reports.

The final phase of Hame’s training took place at an Internet cafe in Raqqa, where an Islamic State computer specialist handed him a USB key. It contained CCleaner, a program used to erase a user’s online history on a given computer, as well as TrueCrypt, an encryption program that was widely available at the time, and that experts say has not yet been cracked.

The external operations unit was on a drive to improve its operational security, after months of embarrassing failures.

Working on security

More than a year and a half earlier, the would-be Cannes bomber, Ibrahim Boudina, had tried to erase the previous three days of his search history, according to details in his court record, but the police were still able to recover it. They found Boudina had been researching how to connect to the Internet via a secure tunnel and how to change his IP address.

Though he may have been aware of the risk of discovery, perhaps he was not worried enough.

Boudina had been sloppy enough to keep using his Facebook account, and his voluminous chat history allowed French officials to determine his allegiance to the Islamic State. Wiretaps of his friends and relatives, later detailed in French court records obtained by The Times and confirmed by security officials, further outlined his plot, which officials believe was going to target the annual carnival on the French Riviera.

Hame was given strict instructions on how to communicate. After he used TrueCrypt, he was to upload the encrypted message folder onto a Turkish commercial data storage site, from where it would be downloaded by his handler in Syria. He was told not to send it by email, most likely to avoid generating the metadata that records details like the point of origin and destination, even if the content of the missive is illegible. Hame described the website as “basically a dead inbox.”

The ISIS technician told Hame one more thing: As soon as he made it back to Europe, he needed to buy a second USB key, and transfer the encryption program to it. USB keys are encoded with serial numbers, so the process was not unlike a robber switching getaway cars.

“He told me to copy what was on the key and then throw it away,” Hame explained. “That’s what I did when I reached Prague.”

Abaaoud was also fixated on cellphone security. He jotted down the number of a Turkish phone that he said would be left in a building in Syria, but close enough to the border to catch the Turkish cell network, according to Hame’s account. Abaaoud apparently figured investigators would be more likely to track calls from Europe to Syrian phone numbers, and might overlook calls to a Turkish one.

Next to the number, Abaaoud scribbled “Dad.”

Hame was instructed to make his way back to Paris, employing an itinerary that mimicked the journey of a backpacker on a summer holiday: He was to travel to Istanbul and spend a few days wandering the streets of the tourist district around Taksim Square.

Then he was to fly to Prague and buy a Czech SIM card. He would again check into a hotel, pretend to be a tourist and leave quick missed calls on Abaaoud’s Turkish phone number. The record of the call would be Abaaoud’s notification of his trainee’s progress. Hame was expected to repeat the procedure for each leg of his journey, including in Amsterdam and then Brussels, before returning by train to Paris.

Once Islamic State leaders knew that Hame had made it home, they would use the encryption and the Turkish drop box to coordinate further instructions, he said.

The mission began on the morning of June 12, when Abaaoud drove Hame and a second recruit to the Turkish border. Both had USB keys with TrueCrypt, and each was handed 2,000 euros, in 500-euro bills, Hame said. Both had the same general agenda — to hit a soft target in Europe — but they were instructed to take separate paths, with Hame returning to France while the second recruit was headed to Spain.

But Hame’s comrade was picked up after he flew to Spain, and under interrogation, he divulged Hame’s plan as well. After being notified, the French police tracked Hame to his mother’s apartment in Paris. Behind a couch, they found his USB stick from the Islamic State, and in his bag a piece of paper showing his login credentials for TrueCrypt. They arrested and began interrogating him last August, almost three months to the day before the worst terrorist attack in French history.

In many ways, it was another clear failure for the Islamic State’s operational security. Hame agreed to cooperate with investigators, and confirmed that the group was bent on attacking in Europe and was already interested in picking out a concert hall to strike.

Yet many aspects of the group’s security protocol were working. In the end, Hame had few specifics he could share with the authorities. He did not know the names or even the nationalities of the other operatives he had met; they had been introduced to him only by their aliases.

Two of Abaaoud’s other small plots around the same time did not go any better. Sid Ahmed Ghlam was ordered by Abaaoud to open fire on a church in Villejuif, south of Paris, according to the report by France’s anti-terrorism police. Instead he shot himself in the leg. Ayoub El Khazzani, the other attacker sent by Abaaoud, was tackled by passengers after his weapon jammed while he tried to open fire inside a high-speed Thalys train last August, officials said.

Though they failed, the thwarted plots kept counterterrorism officials stretched thin in the months before the November attacks in Paris.

“It served to put all of our agencies on edge,” said France’s chief anti-terrorism judge, Marc Trevidic, who debriefed Hame, Ghlam and Khazzani before retiring last summer. “Just like a smoke screen, it allowed them to calmly prepare.”

A signature explosive

Among the clearest signs of the Islamic State’s growing capacity for terrorist attacks is its progress in making and deploying bombs containing triacetone triperoxide, or TATP.

The white explosive powder was found in the suicide belts of the Paris attackers and in the suitcases of the Brussels bombers, as well as in two other ISIS-led plots in 2014 and 2015.

Before ISIS, al-Qaida repeatedly tried, but mostly failed, to deploy TATP bombs, starting in 2001 when Richard Reid tried to destroy an American Airlines flight by sneaking TATP onboard in the sole of his shoe. He was thwarted when the fuse failed to ignite.

TATP has become terrorists’ go-to explosive in Europe because the main ingredients, acetone and hydrogen peroxide, can be found in common household goods like nail polish remover and hair bleach, experts say.

But while the building blocks are easy to come by, TATP is difficult to make, because the ingredients are unstable once combined and can easily detonate if they are mishandled. Over at least two years, Islamic State operatives were working to get it right.

The three bombs found in Boudina’s building near Cannes in 2014 were beverage cans filled with the explosive powder and wrapped in black tape, according to the French court filing in the case.

Though he had successfully cooked the explosive, Boudina was still struggling to set it off. He had jammed a filament into a cavity in the body of each can, most likely to use as a crude fuse, investigators concluded. However, the online searches he had conducted on his laptop just before his arrest indicated that he did not know how to make the final component. He searched “how to make a remote detonator,” “detonation by cellphone,” and finally “where to buy firecrackers?”

By comparison, the team sent from Syria to carry out the Paris assaults in November had ironed out the final details.

Two months before those attacks, the man suspected of handling logistics for the assailants, Salah Abdeslam, stopped by a fireworks shop northeast of Paris to buy a mechanism used to detonate fireworks from a distance, according to the French prosecutor. The Firework Magician shop’s in-house lawyer, Frederic Zajac, remembered little about the young man with a Belgian accent, except that “unlike other clients, he didn’t ask questions about how it all worked.”

Abdeslam is believed to be the only direct participant in the assaults to have survived, and he was arrested last week in Belgium after a continentwide manhunt.

The attackers he had been helping successfully detonated their suicide belts in seven locations in Paris, indicating the group had mastered both how to mix the compound and how to set it off.

“To be able to assemble it safely, and to detonate it repeatedly, suggests a more organized effort,” said Michael Marks, a retired Naval Criminal Investigative Service special agent who was the post-blast investigator on the Navy destroyer Cole. “It suggests a network.”

That network stretched like a web across Europe to at least a dozen other accomplices, including a cell holed up in an apartment in the Brussels neighborhood of Schaerbeek, where two other teams of Islamic State fighters prepared the bombs detonated last week in Brussels Airport and the metro station.

The overpowering odor that comes with refining and storing TATP was noticed by the building’s owner weeks before the bombings, Belgian officials said, but he did not report it until after the attacks.

While each of the explosive vests used in Paris in November had about a pound of finished TATP, the bombs used at the departure terminal of the airport and inside a subway car in Brussels are estimated to have weighed 30 to 60 pounds each, according to Claude Moniquet, a veteran of France’s intelligence service who now heads the European Strategic Intelligence and Security Center.

That marked another level of achievement in making the explosive: The higher the volume of TATP, the more volatile it becomes.

The attacks last week could have been worse: Inside the attackers’ apartment were more of the precursor ingredients used to make the explosive — nearly 40 gallons of acetone and 8 gallons of hydrogen peroxide — as well as a suitcase containing over 30 pounds of ready-to-go TATP, according to the Belgian police.

The one thing the attackers had not thought of was that the taxi they called to take them to the airport had room for only three suitcases, so they abandoned the fourth upstairs, Moniquet said.

Their taxi driver told the Belgian newspaper DH that the customers had refused to let him help them load the heavy bags, and that during the drive to the airport, they sat in tense silence.

The driver could not help but notice a strong odor wafting into the taxi from the sealed trunk.

© 2016 The New York Times Company