When Brussels police caught Salah Abdeslam, suspected sole survivor of November’s suicide assault on Paris, they knew they were in a race against time to stop a new Islamic State attack.
It was the afternoon of Friday, March 18, and one of Prime Minister Charles Michel's cabinet ministers tweeted "We got him!" after Europe’s most wanted man was seized at a house in the capital's Molenbeek neighborhood.
But Michel was worried, according to a government official who was present at the time. The premier raced to his crisis command center from a European summit nearby.
Security forces had orders to increase vigilance but lacked intelligence to justify a citywide lockdown such as Michel imposed after the Paris attacks.
"Our first thought was that … this will set off a ferocious response," the aide told Reuters, speaking on condition that he not be named.
Those fears were well founded. The suicide bombings of Brussels airport and a metro train that killed 28 bystanders laid bare the inability of the Belgian authorities to counter Islamic State militants, no matter how high the level of alert.
Missed connections, leads not followed and suspects let slip have exposed deficiencies in security services. They have also shown how Europe's Syrian-trained Islamist cells can react with deadly speed to events such as Abdeslam's arrest.
"It was a race against time," said Vincent Gilles, head of Belgium's main police trade union SLFP.
But with the intelligence service understaffed — by some estimates by about half the level for other rich European states — it was a race the authorities could not win.
Year on alert
Belgium is, for its size, the biggest European supplier of foreign fighters in Syria. Islamic State has appealed to an alienated generation descended from mostly Moroccan immigrants of the 1960s.
Belgian authorities stepped up their searches for activists after January 2015. That month, days after the bloodshed at Paris magazine Charlie Hebdo, Belgian police foiled a plot in the town of Verviers that revealed an Islamic State campaign to send some of the 300 or more young Belgians who have fought in Syria back to Europe to strike on their native soil.
In Verviers, police killed two men who returned from Syria with Abdelhamid Abaaoud. Killed in a shootout in Paris days after the attacks there, he emerged as "the spider in the web", in the words of a Belgian minister, of an extensive network.
Yet though Belgian authorities questioned numerous contacts of Abaaoud, notably from his old Molenbeek neighborhood, the trail went cold. Among those interrogated and released were Salah Abdeslam and his brother Brahim.
In the first half of 2015, Belgian courts convicted dozens of radical preachers and their followers for recruiting for Syria. But new cells were forming elsewhere.
Last summer, the Abdeslams, petty drug dealers who ran a Molenbeek bar, put together what Salah has since told interrogators was a logistical plan to prepare for the attacks on Paris. Salah drove across Europe more than once and appears to have transported quantities of guns, explosives and people.
It was with shock, after 130 people died on a Friday evening in the French capital and trails led back to Brussels, that Michel's government realized it had an urgent problem.
He locked down transport and public spaces for days as he was near "100 percent certain" of a threat.
At the center of those fears was Salah Abdeslam, whose brother had blown himself up at a Paris cafe. Abdeslam had slipped back across the Belgian border ahead of a French dragnet. The morning after Paris, he went to ground in Brussels.
New resources, too late
Michel pledged cash and legal reforms to beef up a security system that officials accepted was understaffed.
An intelligence service of about 700 staff for a country of 11 million struggled to cope, as did a police force that is about 20 percent below full strength.
Police and security services have also struggled with a lack of communication and coordination across a multiplicity of departments that cross Belgium's Dutch-French language divide.
Two of Tuesday's suicide bombers – Najim Laachraoui and Khalid El Bakraoui – were on counter-terrorism watchlists. The former was a suspected bombmaker for the Paris attacks; the latter rented a safe house for the Paris cell and the flat where police picked up Abdeslam's trail.
Bakraoui's brother Brahim, was a convicted armed robber in breach of his parole who was expelled last July from Turkey. Ankara warned Belgium he had been caught trying to reach Syria.
In December, police in the town of Mechelen had a tip about a family sheltering Abdeslam. The tip included the address where he was eventually apprehended. But officials acknowledge the tip was never passed on to Brussels colleagues.
The revelation has led to criticism — strongly denied — that Mechelen's town hall might prefer to suppress a tip to avoid irritating local Muslims, a key electoral constituency.
In their four-month search for Abdeslam, police pulled in dozens of people, holding 10 by last month.
Dozens of homes were raided to no avail.
Police reject suggestions it was chance that led them to a house in the Brussels borough of Forest on March 15. Four officers were wounded in a shootout before one gunman was killed. The apartment, rented under a false name by Khalid El Bakraoui, the Brussels metro bomber, yielded a fingerprint belonging to Salah Abdeslam. Police homed in on a cellphone he was using, leading to his capture three days later.
Three days of fear
Over the three and half days following that arrest, the government considered locking down Brussels but decided against it because they had no clear clues that an attack was in the offing, the government official said.
When the bombers struck at the morning rush hour on Tuesday, the authorities tried to moved fast.
A taxi driver who took the bombers to the airport led police to the apartment where he had picked them up. That produced a evidence including chemicals and another bomb.
One report said the bombers left it behind after a confused taxi dispatcher sent a smaller cab than they ordered. It also produced a witness who, investigators say, has since identified a third man seen on airport cameras with the two bombers.
Police have been rolling up contacts and acquaintances of those identified, including another suspected plotter in Paris.
Michel’s government is also cracking down on fake documents which seem to have allowed the likes of Laachraoui and Abaaoud, to slip across Europe from Syria.
The government has sought new legal powers over, and in cooperation with, Internet and telecoms firms to track suspects.
But officials caution that it could take years to fill the gaps in the security structures of a country that is host to the European Union and NATO.
So it was with a note of resignation that Belgium's leaders reacted to the worst bloodshed in their country since World War Two: Michel declared simply: "What we feared, has happened."
