NEW YORK/PARIS — Investigators found crates’ worth of disposable mobile phones, used and discarded after being meticulously scoured of email data. All around Paris, they found traces of a consistent and improved bomb-making materials. And they began sketching in the details of a multilayered terrorist attack that evaded detection or prevention until much too late.

In the immediate aftermath of the Paris terror attacks on Nov 13, French investigators came face to face with the reality that they had missed the signs that the Islamic State (IS) was able to mount large and sophisticated international terrorist strikes.

Now, the arrest Friday in Belgium of Salah Abdeslam, who officials say was the logistics chief for the Paris attacks, offers a crucial opportunity to address the many unanswered questions surrounding how they were planned. Abdeslam, who was transferred Saturday from a hospital to the Belgian federal police headquarters for questioning, is believed to be the only direct participant in the attacks who is still alive.

Much of what the authorities know is in a 55-page report compiled in the weeks after the attack by the French anti-terrorism police, presented privately to France’s Interior Ministry; a copy was recently obtained by The New York Times. While much about the Paris attacks has been learnt from witnesses and others, the report has offered new perspectives about the plot that had not yet been publicised.

The attackers, sent by the IS’ external operations wing, were well versed in a range of terrorism tactics — including making suicide vests and staging coordinated bombings while others lead shooting sprees — to hamper the police response, the report shows. They exploited weaknesses in Europe’s border controls to slip in and out undetected, and worked with a high-quality forger in Belgium to acquire false documents.

The scale of the network that supported the attacks, which killed 130 people, has also surprised officials, as President Francois Hollande of France acknowledged. As of Saturday, there are 18 people in detention in six countries on suspicion of assisting the attackers.

French officials have repeatedly warned citizens that more attacks are possible, saying security and intelligence officials cannot track all the Europeans travelling to and from IS strongholds in Syria and Iraq. And Western intelligence officials say their working assumption is that additional IS terrorism networks are already in Europe, with more being formed.

The French police report, together with hundreds of pages of interrogation and court records also obtained by The Times, suggest there are lingering questions about how many others were involved in the terrorist group’s network, how many bomb makers were trained and sent from Syria, and the precise encryption and security procedures that allowed the attackers to evade detection during the three months before they struck.

Taken as a whole, the documents, combined with interviews with officials and witnesses, show the arc of IS’ growth from a group that was widely viewed as incapable of carrying out large-scale terror assaults. And they suggest that nearly two years of previous, failed attacks overseen by the leader of the Paris assault, Abdelhamid Abaaoud, served as both test runs and initial shots in a new wave of violence the IS leaders have called for in Western Europe and Britain.

Focus on Explosives

Diners first saw the young man pacing back and forth in front of the bistro’s awning on Rue Voltaire. What drew their attention, they told investigators in accounts summarised in the police report to the French Interior Ministry, were the bulky layers of clothing he was wearing: An anorak on top of a coat with fur trim, over a vest that could be spotted through gaps in the clothing — excessive even for a chilly November evening.

Just after 9pm, he turned and walked into the bistro, past the covered terrace built around a curved bar.

“He turned and looked at the people with a smile,” said the French police report, offering previously unreleased details. “He apologised for any disturbance he had caused. And then he blew himself up.”

He turned out to be Ibrahim Abdeslam, a brother of the man arrested Friday in Brussels, and his suicide bombing came near the start of a night of carnage that played out at cafes and restaurants, the national soccer stadium and a concert venue.

When the Anti-Criminal Brigade of France’s National Police arrived at the bistro, the Comptoir Voltaire, it found electrical wires in the bomber’s flesh. The wires were still attached to a white object, which in turn was next to a single alkaline 9-volt battery, elements of a detonation mechanism. Officials involved in the investigation say the residue from the explosive used in the bistro tested positive for a peroxide-based explosive, triacetone triperoxide, or TATP. It has become the signature explosive for IS operations in Europe, and it can be made with common products — hair bleach and nail polish remover — easily found over the counter across Europe.

The French police found traces of the same explosive formulation at each of the places in Paris where the attackers detonated their vests, including three times outside the Stade de France soccer stadium; once at the Comptoir Voltaire bistro; twice in the Bataclan concert hall; and once in an apartment in a Paris suburb. Traces were also found in a rented apartment in Belgium occupied by the terrorists in the weeks before the assault, according to forensic evidence revealed by the country’s prosecutor.

The reason the terrorist group uses this particular explosive, said experts, is the availability of the ingredients. But creating an effective bomb can be tricky, and the success in setting off bomb after bomb is indicative of the group’s training and skill.

“Their ingredients, when combined, are highly unstable and can explode easily if mishandled,” said Mr Peter Bergen, director of the National Securities Studies Programme at the New America Foundation, during recent congressional testimony. “To make an effective TATP bomb requires real training, which suggests a relatively skilled bomb-maker was involved in the Paris plot, since the terrorists detonated several bombs. It also suggests that there was some kind of bomb factory that, as yet, appears to be undiscovered, because putting together such bombs requires some kind of dedicated space.”

Since late 2013, records show IS fighters have been training to make and use TATP in Europe. The first aborted attempt was in February 2014, when Ibrahim Boudina, a French citizen who had trained in Syria with the group that was about to become the IS, was arrested in the resort city of Cannes, according to his sealed court file that was obtained by The Times. In a utility closet on the landing of his family’s apartment block, the police found three Red Bull soda cans filled with the white TATP powder.

Still, at the time of his arrest he appeared to be struggling with how to set off the charge. In his court file, among several obtained by The New York Times, investigators said he had been conducting Internet searches for phrases such as “how to make a detonator.”

Nearly two years later, the Paris attackers had clearly progressed. The police report and officials briefed on the investigation noted the uniformity of the parts in the bombs, suggesting a consistent protocol for preparing them.

At the scene of one suicide bombing, at a McDonald’s restaurant about 230m from the French national soccer stadium, the police bagged the bomber’s severed arm. The autopsy showed that a piece of string with a flap of adhesive tape at one end, believed to be the detonation cord, was wrapped around the limb. Along with TATP residue, they again found electrical wires, a 9-volt alkaline battery to drive the detonation, and pieces of metal, including bolts, that had been mounted on the suicide belt as projectiles.

Seeking to blend in with the soccer fans, another bomber had been wearing a tracksuit with the logo of the German soccer team Bayern Munich. His severed leg was found still in the tracksuit and, next to him, again a piece of white string.

A Focus on Carnage

The attacks marked a subtle shift in IS’ external operations branch, which was first publicised in the group’s French-language online magazine, Dar al-Islam, last March.

In the previous small-scale attacks, the IS, much like Al Qaeda before it, had taken aim at symbolic targets, including police and military installations and establishments with clear links to Israel or Jewish interests, like the Jewish Museum in Brussels. But in an interview published in the online magazine, a senior operative for the IS, described as the godfather of French jihadis, advised his followers to abandon the symbolism.

“My advice is to stop looking for specific targets. Hit everyone and everything,” he said.

The attackers in Paris appear to have moved easily between Belgium and France, and in somecases between the Middle East and Europe. At least three of the Paris attackers were wanted on international arrest warrants before the attacks but were able to travel freely. And security services are constrained by the inability or unwillingness of countries to share intelligence about potential terrorists, for legal, practical and territorial reasons.

“We don’t share information,” said Mr Alain Chouet, a former head of French intelligence. “We even didn’t agree on the translations of people’s names that are in Arabic or Cyrillic, so if someone comes into Europe through Estonia or Denmark, maybe that’s not how we register them in France or Spain.”

The attackers also appeared to have studied how to exploit the limited capacity of local law enforcement.

In Paris, the IS for the first time pulled off a coordinated attack specifically designed to spread the authorities thin. The French police were already overwhelmed by the explosions at the stadium and the beginning of the cafe shootings by the time the terrorists attacked the Bataclan concert hall and took hundreds of people hostage. The police report offered extensive details about the siege, as recounted by those who survived it.

The headlining band had just started playing to a full house at the Bataclan when witnesses described first noticing a Volkswagen Polo with a Belgian licence plate approaching the hall, about 9.40pm, said the report.

The lone security guard posted at the concert hall’s main entrance told police that he had seen people falling around him. He began herding people inside, off the street and directing the panicked concertgoers towards the emergency exits.

Before they could get that far, two of the gunmen pushed their way into the main hall, opening fire on the crowd as people hit the ground, lying flat on their stomachs. Those who managed to make it to the emergency exit threw it open, only to come face to face with the third gunman, who was waiting outside. One of the mobile phones used by the attackers contained archived images of the Bataclan’s layout, suggesting they had planned their trap carefully, said the police report.

Through the emergency exit, the third and final gunman shot his way in. By then, the report said, people were shoving themselves into every space they could find. One group found refuge in a room used to store sound equipment. Others made it to the roof. A few sprinted behind the attacker’s backs, managing to slip out.

One hostage identified in the police report, David Fritz Goeppinger, who confirmed the account in a telephone interview, described how the gunmen had instructed the captives to sit in front of the closed doors as human shields, he said. “We were their protection in case someone tried to shoot from outside,” he said in the interview.

The attackers seized mobile phones from the hostages and tried to use them to get onto the Internet, but data reception was not functioning, Mr Goeppinger told the police.

Their use of hostages’ phones is one of the many details, revealed in the police investigation, pointing to how the IS had refined its tradecraft. Court records and public accounts have detailed how earlier operatives sent to Europe in 2014 and early 2015 made phone calls or sent unencrypted messages that were intercepted, allowing the police to track and disrupt their plots. But the three teams in Paris were comparatively disciplined. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims.

According to the police report and interviews with officials, none of the attackers’ emails or other electronic communications have been found, prompting the authorities to conclude that the group used encryption. What kind of encryption remains unknown, and is among the details that Abdeslam’s capture could help reveal.

Using their hostages’ phones, the attackers attempted to reach police, but were initially frustrated by the “Press 1” or “Press 2”, menu of options, said a 40-year-old woman whose phone was used by the gunmen, and who was interviewed Saturday. She spoke on the condition of anonymity because she did not want to draw attention to her ordeal.

After numerous delays, one of the attackers began using a hostage’s mobile phone to send text messages to a contact outside. At one point one of the gunman turned to a second and said in fluent French, “I haven’t gotten any news yet,” suggesting they were waiting for an update from an accomplice in another location. Then they switched and continued the discussion in Arabic, according to the police report.

At nearly midnight, two hours after they took over the Bataclan, the gunmen began negotiating in earnest with the police.

“We want to talk to someone!” the gunman demanded, then turned to his demands for France to stop military strikes in Syria: “I want you to leave the country. I want you to remove your military. I want a piece of paper signed that proves it!” If not, he threatened, “I’m killing a hostage and throwing him out the window!”

One of the terrorists pulled out a laptop, propping it open against the wall, said the 40-year-old woman. When the laptop powered on, she saw a line of gibberish across the screen: “It was bizarre — he was looking at a bunch of lines, like lines of code. There was no image, no Internet,” she said. Her description matches the look of certain encryption software, which IS claims to have used during the Paris attacks.

The tallest of the three attackers was 1.88m tall. He had an explosive belt strapped to his body and held a detonator in his hand. At one point, he stepped into the orchestra pit and started playing the xylophone, the whole time “laughing sadistically”, according to witnesses quoted in the report.

They would identify him later from his mug shot: He was Samy Amimour, a former bus driver.

France’s Anti-Criminal Brigade was the first law-enforcement team to break through the Bataclan’s doors. The division Commander, Guillaume Cardy, and a colleague got in through the main doors and managed to shoot one of the attackers, who was on the stage. Wounded, he detonated his vest, said the report.

The two remaining gunmen returned fire, forcing Mr Cardy to take cover. Members of another Paris police division tried to reach the wounded hostages, but were also forced to take cover, said the report.

Together the police charged the two surviving gunmen, and after a heavy barrage of fire, they killed the second before he could detonate his vest. The third gunman then blew himself up. In the end, it took four elite brigades to stop three gunmen, said the report. THE NEW YORK TIMES

This is the first of a two-parter on Islamic State’s evolving tactics in staging large-scale terror attacks in Paris on Nov 13. Look out for Part 2 tomorrow on how the suspects evaded capture, including using disposal phones to avoid detection.