When a few young individuals started to leave Belgium in 2011 in order to wage jihad in Syria there was no sense of alarm. Young radicals had departed before—for Afghanistan, Chechnya or Somalia. The security services knew how to handle them. However, in 2012, as intelligence analysts began to put the numbers together, they realised that something different—and much bigger—was at play. In his first public statement on the topic, Belgium’s former head of Intelligence, André Vandoren, observed in April 2013 ^[1]:

‘This is absolutely the most difficult case we ever worked on…. If some of these individuals come back [to Belgium] with training and know-how, they can present a threat to our society’.

That prediction became tragically real on Tuesday 22 March 2016. The attacks in Brussels—as with those in Paris four months earlier—were carried out by a small group of so-called ‘returnees’. Belgium had already become the target of an operation by a returnee, two years earlier, when Mehdi Nemmouche killed four at the Jewish museum in Brussels. And the alarming signals kept on growing. Over the past year, three or four individuals have returned to Belgium every month.

With the highest number of ‘foreign fighters’ per capita in Europe, Belgium is particularly exposed to this new threat. According to the latest figures provided by Interior Minister ^[2], Jan Jambon, 837 individuals were on the intelligence services watch list as at October 2015. Of those, 273 persons were presumed to have travelled to Syria or Iraq (including 80 now believed dead) and 13 were believed to be en route to wage jihad. At that time, a total of 134 were believed to have returned from Syria/Iraq; and 352 were presumed to have radicalised.

These figures are puzzling and worrisome. Until a few months ago, experts studying the Islamic State (ISIS) considered that, unlike al-Qaeda in earlier times, the priority of the group was territorial conquest in Syria and Iraq, not terror attacks in Europe. Young European radicals were more encouraged to join ranks with ISIS in Syria than to take up arms in Europe. In an article ^[3] published last summer reviewing ISIS attacks and propaganda material Thomas Hegghammer and Petter Nesser concluded that ISIS had not ‘gone global’ yet, as it didn’t seem to have developed a centrally-coordinated strategy to target Europe. But it had been more successful than al-Qaeda had been in triggering ‘individual jihad’ operations by unaffiliated sympathisers in the West.

The attacks in Brussels and Paris betray a shift in the group’s strategy. The more the investigations on these attacks progress, the more connections appear between the two operations. Salah Abdeslam, the logistician behind the Paris attacks, was protected by members of the Brussels commando ^[4] upon his return. Najim Laachraoui, the alleged bomb-maker of the Paris attacks, was one of the suicide-bombers—and likely bomb-maker—in Brussels airport. The Bakraoui brothers, two other suicide-bombers in Brussels, had rented one apartment that had been used by some members of the Paris commando few days earlier. And more connections continue to be unearthed. Belgian and French investigators are clearly dealing with one organised network.

The Abaaoud network has extensive connections, many of which remain unknown. After the Paris attacks, Abaaoud boasted to a relative ^[5] that he was leading a network of 90 terrorists that had returned from Syria. Although he may have exaggerated the figure, the possibility of other individuals or active cells should be taken seriously. More than 30 individuals connected to this network have already been arrested or killed. Beyond Abaaoud, officials have claimed ^[6] that ISIS may have trained more than 400 fighters specifically to target Europe.

The network’s degree of structure and coordination remains unclear, but it’s becoming increasingly evident that ISIS’s leadership has backed the emergence of a Western European network. According to a recent report ^[7] in The New York Times based on leaked French intelligence and judiciary documents, ISIS created a special unit in charge of external operations in early 2014, which falls under the overall supervision of ISIS leader, Abu Bakr al-Baghdadi. Abaaoud most likely was in charge of that unit’s French-speaking contingent. Ibrahim Boudina, recruited and trained in that unit, should have become the first returnee to strike Europe. But he was arrested in Cannes in February 2014, before he could strike. Another former recruit, Reda Hame, arrested in August last year, confessed to The New York Times: ‘it’s a factory over there. They are doing everything possible to strike France, or elsewhere in Europe’.

What does all of this tell us? First, we’re dealing with a much bigger threat than some may have previously assumed. In addition to the threat of lone wolf attacks inspired by ISIS propaganda, Europe’s now confronted with a well-organised and trained operational network. The impact of Abaaoud’s death is still to be assessed, but the Brussels attacks emphasise the resilience of his network. In addition, other terrorist cells or possibly networks may still appear elsewhere in Europe, unconnected to Abaaoud.

Second, ISIS operations in Europe are becoming increasingly sophisticated. The attacks in Paris and Brussels involved more professional logistics, weaponry and coordination than previous attacks of a similar vein. Clearly, ISIS has scaled up its operations in Europe.

Finally, ISIS’s ‘strategic shift’ didn’t happen overnight. It was the result of a long-term plan to export jihad to Europe and to gradually expand by opening of new franchises, for instance, in Libya ^[8] (PDF). Those occurrences aren’t surprising, and yet, no one was able to prevent it. Now that ISIS has gone global, Europeans should step up their counterterrorism efforts quickly, and in close cooperation with international allies and partners.