MSA Intel

Information continues to emerge regarding the coordinated terrorist attacks in Brussels that killed 31 people and injured 270. Authorities now believe that five terrorists were involved in the attacks, three at the airport and two on the metro. The two suicide bombers at the airport have been identified as Ibrahim El Bakraoui and Islamic State in Iraq and the Levant (ISIL) bomb maker Najim Laachraoui. A third, unidentified man involved in the airport attacks remains at large. El Bakraoui’s brother Khalid was identified as the suicide bomber who carried out the metro attack. A second, unidentified individual is also believed to have participated in the metro bombing; however, it is unclear whether he is dead or alive.

After searching a residence where the suspects stayed, police uncovered more than 30 pounds of the explosive Triacetone Triperoxide (TATP), 40 gallons of acetone, screws and other bomb-making materials. The bombs in the airport were reportedly made using ammonium nitrate (ANFO), estimated at 44 pounds per device, but it is likely that TATP was used to initiate the explosives chain. They also found a computer that contained what appeared to be a suicide note from Ibrahim El Bakraoui, which suggested the group may have moved up the timeline of their attack following last week’s arrest of Salah Abdeslam. Furthermore, there is evidence that ISIL militants were surveilling the head of Belgium’s nuclear research and development program. The 10 hours of video surveillance was uncovered during a raid connected to the Paris attacks in Belgium last December. There are unconfirmed reports that the El Bakraoui brothers were responsible for the covert video. Although it is unclear if there was a specific plot to attack nuclear plants, there is speculation that the group may have shifted their target to the airport and metro after security was increased at several facilities.


Past operations indicate that it is unusual for a bomb-maker to participate in an attack, given their value to the group and the inherent risks involved. In this case, there is speculation that Laachraoui participated in the airport attacks because the group thought they were likely to be caught following Abdeslam’s arrest. Although at least one attacker remains at large, he is unlikely to pose an offensive threat. However, if boxed in by police, there is potential for additional violence as was seen during the Madrid train bombing arrests and the Hofstad group takedown in 2004. The amount of TATP uncovered in the residence required a great deal of high concentration peroxide and acetone. The building would likely have been filled with detectable vapors, suggesting some neighbors may have suspected nefarious activity, but did not report it to the police. Additionally, due to the large quantity of explosive materials, there is potential that other individuals were involved in creating the devices.

Overall, ISIL has shifted their tactics from small-scale attacks on symbolic targets, including security installations and religious institutions, to more large-scale, high-profile attacks. Senior ISIL operative Boubaker al-Hakim advised followers to abandon attacks related to symbolism, and to “hit everyone and everything.” Before the November 2015 Paris attacks, ISIL fighters from Syria and Iraq  typically employed a single mode of operation, such as shootings, hostage-taking or explosives detonation. However, both the Paris and Brussels attackers used multiple methods to conduct the attacks, allowing the group to inflict mass casualties and hinder the emergency response by dispersing first responders to multiple locations. This indicates an escalation in tactics. Additionally, the use of TATP in attacks allows terrorist groups like ISIL to fulfill these goals, as the peroxide-based explosive is effective in killing and wounding if used correctly.

TATP in Terrorist Tradecraft

TATP, is a peroxide based explosive that is being increasingly used by terrorist groups like the Islamic State in Iraq and the Levant (ISIL) because of the availability of components and deadly nature of the chemicals involved when combined. TATP is popular among terrorist groups because they can compile the required chemicals without attracting attention from authorities. Common household products that can be purchased at drug stores, such as nail polish removers, hair dye and various disinfectants, contain ingredients necessary to create a TATP explosive. Additionally, TATP does not require a commercial metal detonator, making it more difficult to detect through traditional screening methods. TATP can also detonate in small spaces, such as a laptop, print cartridge or soda can, making it attractive to terrorists hoping to go undetected until their attack is launched. While TATP is dangerous to make due to its instability, numerous recipes and instructional videos are available online.

*An MSA Security SmartTech Senior Bomb Technician provided the following commentary on the Brussels attack:

The Brussels attacks, involved four devices and a large amount of explosives were subsequently recovered at a safe house, possibly Triacetone Triperoxide (TATP). The devices were detonated by suicide bombers at the airport and metro station. A third device, reported to be approximately 35lbs., was left behind unexploded at the airport, and reports indicate that it was later detonated in a secure area. Though unconfirmed, this detonation was most likely performed as a render safe operation by EOD personnel.

A tip from a cab driver led authorities to a safe house. During the raid, police found approximately 15kg of explosives, 150 liters of acetone, 30 liters of oxygenated water, detonators, a suitcase filled with screws and nails as well as materials, such as plastic boxes, needed to pack the explosives.

Two of the suicide bombers were also photographed wearing black gloves on their Left hands. There is speculation that the gloves may have been hiding detonation triggers and/or minimizing static electricity from causing a premature detonation. During the November 2015 Paris attacks, the gunmen were seen pacing the hall with detonators in their hands. Following the attacks, officials found electrical wire, nine-volt batteries and melted plastic next to the bombers’ bodies, which were believed to have been part of the detonation mechanisms.

The large number of deaths and injuries, as well as the significant structural damage in Brussels, suggests that more than just explosive suicide vests were responsible for the carnage. Suicide belts like the one used in Paris carry about one pound of TATP. The blast pressure greatly damaged the structural integrity of both targets, which is indicative of a larger amount of explosives than was utilized in Paris. This is also confirmed by the amount in the bag that was left behind in the airport and the explosives recovered at the safe house.

Due to evidence recovered in this case as well as in the Paris incident, it appears that TATP was the explosive charge used to initiate the attacks. TATP is easily detonated in many ways such as shock, friction, flame or electrical charge. However, TATP is volatile, and carrying large amounts can cause a problem in transit. This means that it was not necessary for all the explosives to be TATP as it can also cause a detonation in conventional high explosives and blasting agents such as ANFO. ANFO was reportedly found at the scene of the airport explosion. The bulk of the explosives was most likely packed inside the bags and detonated by a firing train which initiated from the suicide vests and body-borne switch. There is also a strong possibility that the bags contained secondary independent detonation circuitry should it have been necessary.

Subscribe to Blog