It’s slowly becoming clear that as horrific as the Barcelona attack was, it could have been much worse. The cell was planning to use a homemade explosive device to kill hundreds at landmarks across the city, including the historic Sagrada Familia cathedral. It seems that what led Younes Abouyaaqoub to drive a van down Las Ramblas with the aim of killing as many people as he could was the accidental explosion of the cell’s safe house in Alcanar, 200 kilometres south of Barcelona, where the group stored approximately 120 gas canisters. Abouyaaqoub, a qualified electrical engineer, was shot and killed in Subirats, which is 60 kilometres west of Barcelona, four days after he drove through Las Ramblas.

Hours after the attack, Spanish police foiled a second vehicle-led attack in Cambrils, a seaside resort 120 kilometres southwest of Barcelona. Police shot dead four members of the cell, one of whom was Abouyaaqoub’s younger brother, Houssaine (a fifth member survived).

Initially, four men were arrested in connection with the attack: Salah al-Karib, Mohammed Aallaa, Mohamed Houli Chemlal and Driss Oukabir. Aallaa has since been released on bail due to insufficient evidence to extend his detention (but his younger brother Said was killed by police and his other brother Youssef died in the Alcanar house). Chemlal has claimed that the cell was planning a much larger atrocity, although there’s no evidence to substantiate that claim. Driss Oukabir allegedly rented two vans, one of which was used in the Las Ramblas attack; he says he rented the vehicles to help his friends move house.

According to police, the men were wearing suicide belts that were later found to be fake. The attackers drove to Cambrils in an Audi A3, which it is believed was owned by Aallaa. The men were shot after they rushed out of the car carrying knives, machetes and axes (it’s worth noting that they don’t appear to have had semi-automatic weapons). Abouyaaqoub and someone else allegedly drove the same Audi to Paris a few days before the Las Ramblas attack, though the purpose of trip remains unclear.

The leader of the cell was 42-year-old Moroccan-born Abdelbaki Es Satty. In April 2014, after serving two years for drug-smuggling in Spain, Es Satty faced an expulsion order. He successfully contested it, arguing that expelling him would breach Spain’s commitment to international law. In November 2014, Es Satty lodged an application for asylum with Spanish authorities. While that was being considered, the Moroccan-born imam could travel within the EU’s Schengen states. In 2016, he headed to Belgium, where he became an imam of a mosque in Diegem. He left after three months because the mosque’s leader, Soliman Akaychouh, had asked him to produce evidence that he hadn’t been involved in any criminal activity, which he was unable to do.

In March 2016, Es Satty took up residence in the Girona town of Ripoll, where he became an imam in one of the two mosques in the city. He lived in a small flat and has been described as ‘a loner’ and ‘perfectly normal imam’. It’s reported that the town had found it hard to find an imam. Es Satty was hired even though Belgian authorities, alerted earlier by Akaychouh, had informed the Catalan interior ministry that they had concerns about him. It now appears that the Catalan regional police had visited the mosque on several occasions, though they never advised the president of the mosque that Es Satty had a criminal record. It remains unclear how the cell was formed, and whether it had direct or even indirect ties to IS, though one would assume that Es Satty and Abouyaaqoub met at the mosque where Es Satty was working, as Abouyaaqoub was a resident of Ripoll.

When Es Satty was in prison he reportedly became close to Rachid Aglif, a Moroccan, who was one of the 2004 Madrid bombing ringleaders. Spanish authorities had a policy of dispersing ETA prisoners, but that hasn’t been done with Islamist prisoners. Questions need to be asked about why and how Aglif was able to interact with other prisoners and whether he managed to radicalise other inmates. Spain’s prison deradicalisation program centers on rehabilitation and reintegration, but it’s unknown what parameters are used to assess whether an individual has been rehabilitated.

As more information has come to light about Es Satty and the activities of the cell, a familiar criticism has been levelled at Spanish authorities: once again, human rights law has allowed a ‘bad’ person to stay in Europe. Critics are quick to point out that information obtained by security services doesn’t lead to criminal charges. That feeds into the narrative that the system allows people like Es Satty to exploit democratic institutions to commit acts of violence.

Detecting terror cells has become exceedingly difficult because they increasingly employ low-tech tools, such as cars and knives, and use everyday ingredients to develop explosive devices. This means that security services can’t rely on forensic systems such as the Integrated Ballistics Identification System, which was recently used in Pakistan to help dismantle terrorist cells linked with the Lashkar-i-Jhangvi and Tehreek-i-Taliban groups.

Terrorist cells in Europe are evolving to address the EU’s improved detection mechanisms and are increasingly turning to high-impact, low-cost operations. In the case of the Barcelona attack, the only cost was the renting of the vans. That’s not an expensive process, and it’s virtually impossible to stop, since anyone with a valid driver’s licence can meet the rental requirement. The Barcelona and Cambrils attacks have again highlighted the need for security services to constantly adapt, develop and evolve their counterterrorism strategies.