SALZBURG, Austria — On a crisp morning last October, 198 migrants arrived on the Greek island of Leros, all of them seemingly desperate people seeking sanctuary in Europe. But hiding among them were four men with a very different agenda.
The four were posing as war-weary Syrians — all carrying doctored passports with false identities. And they were on a deadly mission for the Islamic State.
Two of the four would masquerade as migrants all the way to Paris. There, at 9:20 p.m. on Nov. 13, they would detonate suicide vests near the Stade de France sports complex, fulfilling their part in the worst attack on French soil since World War II.
The other two men would not make it that far.
Stopped upon arrival in Greece for lying about their identities, they were delayed — but only for a few weeks before being granted permission to continue their journey deeper into Europe. Their story — including key details never before disclosed — offers a cautionary tale for a continent suddenly facing its worst security threat since the end of the Cold War. The men’s journey from the battlefields of Syria was reconstructed through interviews with intelligence officials and from French investigative documents obtained by The Washington Post, as well as an interview with an Islamic State commander.
European security officials say they think that the Islamic State has seeded terrorist cells on the continent over the past year and was able to do so in part because the European Union failed to come to grips with a migrant crisis that opened a funnel for the militant group.
Europe is now working with Turkey to bar its doors, ending the waves of irregular migration that washed over the continent last year. But more than a million migrants — a record — have already entered. Hundreds of thousands of them, European intelligence agencies say, may have done so without thorough checks at their entry point: Greece.
The vast majority of migrants were genuinely fleeing war and poverty. But over the past six months, more than three dozen suspected militants who impersonated migrants have been arrested or died while planning or carrying out acts of terrorism. They include at least seven directly tied to the bloody attacks in Paris and Brussels.
The Islamic State is gloating that they have far more lying in wait.
“We have sent many operatives to Europe with the refugees,” an Islamic State commander said in an interview over an encrypted data service. “Some of our brothers have fulfilled their mission, but others are still waiting to be activated.”
The accounts of the two men who landed in Leros with plans to die in France, only to stop short of their goal, expose the weaknesses in a haphazard system that has created risks of unknown dimensions.
“The Greeks failed in protecting the borders into the E.U.,” said a senior European intelligence official who, along with 11 other senior European, U.S. and Arab officials interviewed for this story, spoke on the condition of anonymity in order to discuss classified information.
He added, “And we all failed by not pushing hard enough to establish that security.”
In early September, just a few weeks before the four men landed on Leros, they were invited to attend a secret meeting in a central Syrian city controlled by the Islamic State.
Two of them — the ones who would blow themselves up outside the Stade de France — were later glorified in an Islamic State video as unnamed militants from Iraq. The other two men, both round-faced and lightly bearded, were Mohamed Usman, a Pakistani who claims to be 23 years old, and Adel Haddadi, a 28-year-old Algerian.
Usman and Haddadi had joined the Islamic State in 2014, the men would tell European investigators. In Syria, they received extensive training with automatic weapons, but neither was a stranger to extremism.
Haddadi had previously been on the watch lists of Algerian intelligence for his activities; Usman was suspected of links to Lashkar-e-Taiba, a radical Pakistani terrorist group tied to the 2008 siege of Mumbai, according to two senior European security officials.
That September meeting in Syria would prove fateful to their futures. In the living room of a home, according to their accounts, a senior Islamic State official told them that the time had come to leave the caliphate.
“You are on a mission to go to France, to kill, to become a martyr,” an Islamic State commander told them, according to their testimony, which was cited by a European security official.
The men, in interviews with European investigators, would later recall an intense sense of pride at being picked for such a mission.
“They were happy and honored that they were chosen to die for the cause and for Allah,” said the European security official. “They were told that they would go to paradise.”
To get as far as Leros, the four men were spirited out of Syria and into Turkey, where they made their way to the coast. From there, they told investigators, they took a smuggler’s raft laden with migrants. The vast majority of asylum seekers departing from Turkey were arriving on Greek islands — some of which lie a brief 30-minute boat ride away. The numbers of arrivals were so large, in the thousands per day, that Greece — a nation brought to its knees by recession and E.U.-imposed budget cuts — could not handle the caseloads.
Frontex, the E.U.’s border agency, provided some preliminary vetting. But managing the masses was largely left to the overwhelmed Greek Coast Guard and to local island police, who were more used to chasing pickpockets than screening for possible terrorists.
Many of the new arrivals — particularly Syrians fleeing war — had no passports or legal travel documents. Yet European intelligence agencies and security analysts now estimate that up until the Paris attacks in November, only about 20 percent of the new arrivals were being thoroughly questioned and checked.
“The fact that only about 20 percent of those who entered Greece were fully processed allowed for a lot of cracks in the system,” said Ioannis Michaletos, an Athens-based security analyst. “This increased security risks in Greece but also for the rest of Europe.”
In an interview, Zacharoula Tsirigoti, lieutenant general of the Greek police, conceded her forces were overwhelmed. Greece, she said, had pleaded with the E.U. for more help, but until the Paris attacks, that assistance — including requests for more staff and machines to enter migrants’ information into a regional database known as Eurodac — was not forthcoming.
“We had been asking for support knowing we needed more specialized personnel in the islands and more Eurodac machines,” she said. “But we received very little. Everyone knew we were facing huge financial problems. So for months we had to make do with what we had, hoping help would arrive.”
On the morning of Oct. 3, the four terrorists tried to blend in with the migrants who had come ashore that day. According to a manifest, they were among at least 47 asylum seekers who said they were Syrians fleeing war. But there was also a dizzying array of other nationalities, including Somalis, Yemenis, Afghans and Palestinians.
When their turn came, the two Iraqi militants showed authorities doctored Syrian passports, according to the classified French files obtained by The Post. Remains of the documents found near their bodies at the Stade de France suggested they had come from a cache of more than 3,800 passports — all authentic — seized by the Islamic State after its major advances in Syria in 2013.
While the passports had been tampered with to insert new photographs, they otherwise appeared real to the eye and touch. The men’s claims of being Syrian asylum seekers were not seriously questioned by Frontex or the Greeks. Along with dozens of other migrants who landed that day, they were not detained and merely told to leave Greece within six months.
Classified records show the Iraqis who claimed to be Syrian — and who still have not been identified — then quickly traveled over land to Serbia, where they registered at a refugee camp in Presevo on Oct. 7. By November, they had linked up with the other assailants involved in the Paris attacks.
On Nov. 13, they became the only non-European-born attackers to take part in a series of assaults that saw nine men kill 130 people at different locations in Paris. But that day, what was nine assailants might have been 11, possibly leading to even more victims but for the grace of a few extra questions in Leros.
Like the two Iraqis, Usman and Haddadi also produced falsified Syrian documents that senior European intelligence officials now think came from the same Islamic State stash of seized passports. But when questioned by Frontex, the two men, unlike the Iraqis, crumbled.
Usman, a Pakistani, did not speak Arabic well — quickly betraying his claim to be Syrian. Haddadi knew almost nothing about the city he said was his birthplace: Aleppo, Syria.
Under E.U. guidelines, the most the European border agency could do was pass them on to the Greeks. So that’s what they did, and the local authorities promptly lumped them in with a then-surging backlog of economic migrants who were using fake documents to enter the asylum system.
Both men were transferred to the larger Greek island of Kos, where they were given lightning legal judgments. In what became a customary practice in Greece, Usman and Haddadi received suspended three-month sentences along with an order to leave the country within a month. It didn’t matter how or which way they went.
After gaining their freedom on Oct. 28, Haddadi, the more senior of the two, quickly sent a text via the messaging app WhatsApp to their Islamic State handler in Syria.
“We need money,” it simply said, according to intelligence officials with access to the pair’s phone records.
That money soon arrived via the same method often used by migrants — a wire from Turkey to Greece. Now flush with cash, the two men continued their journey.
They were only 25 days behind their Islamic State comrades traveling to Paris.
The men, taking a path frequently traversed by migrants, embarked on a trek through the western Balkans.
They knew their destination was France, but the men said they had not been given precise instructions on when or where the attacks would unfold. They also were unaware of the identities of the other Paris attackers besides the two Iraqi militants they had traveled with. They were to get further instructions along the way.
The Islamic State commander who spoke to The Post said that was the way the group was seeking to operate.
“The cells don’t necessarily know one another; that’s to protect other operatives,” he said. “So even if one or two get arrested, they won’t be able to lead to other operatives, because they don’t know them. We are not finished yet with Europe, since they didn’t seem to have understood our warnings.”
But their delay in Greece had a major side effect that may very well have saved lives: As the nine attackers were fanning out across Paris on the evening of Nov. 13, Usman and Haddadi were still on the road. After passing through Macedonia, Serbia, Croatia and Slovenia, they arrived in the shadow of the Alps: Austria.
And they had received fresh orders to stay put.
The men entered Austria without passports and offering fake names, while this time claiming to be from their real countries, Pakistan and Algeria. On Dec. 4, both men applied for asylum in Austria and then took up residence in a teeming refugee center — a converted truck storage depot — about a mile from the German border.
Their phone records show that they had begun reaching out to contacts all over Europe, a list that, investigators say, included other newly arrived migrants as well as longer-term immigrants tied to the region’s criminal underworld.
European authorities had immediately launched a massive investigation following the Paris attacks and were beginning to retrace the attackers’ steps. After finding a Syrian passport at the Stade de France, investigators ran fingerprints and discovered that two of the dead men had arrived in Greece as Syrian migrants on Oct. 3. With the aid of German and U.S. intelligence, a manifest of the day’s migrant arrivals — including photos — was run through databases and a face-recognition system of known radicals and Islamic State militants, according to a senior European intelligence official.
The searches returned two hits — men also claiming to be Syrian who had arrived that day.
On Dec. 10, Austrian police in Salzburg received their photos and fake Syrian names from French intelligence. Within four hours, they had tracked them down to the refugee center on Münchner Street. A SWAT team moved in, arresting the two men in their room. As they were taken into custody, Haddadi attempted to pass his SIM card to another migrant, who was later arrested.
During 150 hours of interrogation, both men would tell their stories. They are now being held at an undisclosed jail in Austria, and based on their testimony investigators are pursuing various leads that have already led to the arrest of two more migrants in the same Salzburg camp where the men were living. Officials expect that the two men will ultimately be extradited to France to stand trial in connection with the Paris attacks.
“They are sad because they are still alive, because they feel they should have been martyrs,” said a European security official. “They are sad they did not die with the others in France.”
Elinda Labropoulou in Athens, Stephanie Kirchner in Berlin, Virgile Demoustier and James McAuley in Paris, and Greg Miller and Steven Rich in Washington contributed to this report.