In the aftermath of the Paris attacks, officials carried out waves of raids and arrests to try to break up terror cells across Europe. As in any criminal investigation, the crime scene provides key evidence that leads investigators to suspects still at large.
But as former counterterrorism officials told VOA, investigations of terror attacks differ in two key aspects: They're accelerated by the possibility of another attack, and a wealth of information about the suspects spreads across social media.
“After a major attack, you’re always worried about the next attack, so you want to make sure you figure out who is in that network and how you take down that network before they commit another attack,” said Seamus Hughes, deputy director of the Program on Extremism at George Washington University.
The investigation begins at the crime scene. As with any criminal investigation, police seal off the area and forensic teams go in to dust for fingerprints and collect evidence. It’s the speed at which this is done that makes a terror attack probe different.
“The French police were desperate to move that at an incredibly accelerated rate because there was the great fear that there was going to be another terrorist action taking place, maybe within the hour,” said Raymond Batvinis, a former FBI agent who has run counterterrorism training sessions since the September 11, 2001 attacks on the United States.
The evidence at the crime scene combined with eyewitness interviews can lead investigators to a search online, where valuable data on locations, connections and motives can help build a background profile.
“You’re collecting all of these phone numbers, all of this data, all of this email data, all of the texting data, all of the Facebook and Twitter data, and they’re building up a profile of the individual, of who his or her contacts are,” Batvinis said.
Social media — the connection point for so many terrorists — can speed up the investigation. The demographics of potential extremists lend themselves particularly well to communication on digital platforms.
“Given the ages of the attackers and most people joining ISIS, they tend to be younger, which means they’re on social media," Hughes said. "They have a profile. They have a sense of it. They’ve been using it for years and you can get a sense of who their network is. You can see them when they pop their head up."
Working off that real-time information can lead investigators to the neighborhoods where the terrorists live.
“We would be knocking on doors, we would be ringing bells, we would be there all night getting people out of bed and saying, 'Your name showed up. Let’s sit down and have a conversation,' ” Batvinis said.
Batvinis and Hughes said those conversations could range from the helpful to the confrontational. Many investigators go into such sessions hoping to establish a rapport with the interviewees that will yield the small pieces of information that contribute to the larger picture.
Ultimately, Batvinis said, it is up to an experienced investigator to know how seemingly disparate and often scattered pieces of information fit together and lead to the decision to stage a raid.
“It’s not scientific. The tips come in and you look at them, and frankly it requires an experienced eye to say, 'We’re going to prioritize this.' ”
Ultimately, the pressured timelines of a terrorism investigation led to the raids seen in Paris and Brussels, which could prevent future attacks and provide investigators with the crucial information for criminal prosecutions.