ATbar Paris Police Headquarters Stabbings – The “insider Threat”

Paris Police Headquarters Stabbings – The “insider Threat”

27/10/2019 | by Karmon, Ely (Dr.)  

On October 3, 2019, a police employee stabbed five colleagues at the Prefecture of Police on the Île de la Cité in central Paris, killing four police officers as well as seriously injuring a woman.

The attacker, 45-year-old Mickaël Harpon, an IT specialist who did administrative work at the station since 2003, had held top secret security clearance renewed in 2008 and 2013, giving him access to all computers in the police directorate of intelligence, known as the DRPP, including the watchlist of terror suspects, addresses of police officers and data on French citizens and their families who had returned after they fought in the Syrian war.

The perpetrator had converted to Islam a decade ago and attended mosque rituals twice a day. Colleagues had reported Harpon in 2015 for voicing support for the attack on Charlie Hebdo journal offices, but nothing was done. He stopped wearing Western clothes and talking to women. Ties between Harpon and a hardline Salafist imam were also confirmed. Harpon and his wife, a Moroccan Muslim, exchanged 33 text messages the attack morning, all of a religious nature. “May God forgive you,” was her last message to him.

French police have arrested five people linked to the knifeman. One of the people arrested is an imam who officiated at a mosque in the town of Gonesse which Harpon attended. That imam is on France's "Fiche S" list of potential security risks; he was not the principal imam at the mosque and did not preach on Fridays.

A USB flash found at Harpon's office included ISIS propaganda material, beheading videos, and details of police officers who worked with him. Officers are now investigating possible links with the June 2016 Magnanville stabbing, in which two police officers were killed at their home by Larossi Abballa, an Islamist who pledged allegiance to the Islamic State.

France's interior minister Christophe Castaner acknowledged that officials should have kept a closer eye on the Paris police after investigators found evidence he had supported an extreme version of Islam. Castaner has come under fire after initially claiming that Harpon had never given the "slightest reason for alarm" ahead of the attack.

The DRPP had dropped surveillance of the Kouachi brothers, who committed the atrocity at Charlie Hebdo in 2105, and of one of the killers in the Bataclan massacre. It also ignored a reference in a text message exchanged by Islamists to Saint-Étienne de Rouvray, a small town in Normandy. One week later, they murdered a priest there.

The killings have raised serious questions about how police failed to notice various signs of Harpon’s radicalization in recent years, despite France being on high alert over a wave of deadly jihadist attacks. Le Parisien daily reported that 19 ministry employees are currently under surveillance by anti-radicalization investigators. In June, a parliamentary report on radicalization within the public services spoke of 30 suspected cases out of the 150,000 police officers and 130,000 gendarmes in France.[1]

French police have re-opened an internal investigation into the suspected Islamist sympathies of a senior police officer who works in a leadership role in a unit that has access to a highly sensitive listing of people with links to terrorism. Five police sources said there has been a culture of reticence inside the police about reporting colleagues’ possible radicalization to superiors, driven in part by concerns about appearing racist or anti-Muslim.[2]

Indeed, this major terrorist incident raises the larger question of the insider threat in law enforcement, intelligence, military agencies and sensitive infrastructure facilities (airports, petrochemical and power plants, etc.).

France is the European country most threatened by jihadi radicalization. With a Muslim population at 5,720,000 or 8.8% of the total population, almost 2000 French citizens represent the largest jihadi contingent of Foreign Fighters in Syria and Iraq. According to a June 2019 official report for the French National Assembly, as of May 2019, 21,039 individuals were registered in the Signal Processing File for the Prevention of Terrorist Radicalization (FSPRT), 1,131 additional individuals enrolled in the year 2018. At the beginning of the year 2019, 12,809 cards are said to be "active", that is to say, monitored by the services, nearly 30% of those converted to Islam.

A terrorist attack took place on 26 June 2015, when Yassin Salhi, a North African Muslim, drove his van into gas cylinders at a gas factory in Saint-Quentin-Fallavier near Lyon, France, which caused an explosion that injured two people. He was driving a van with his dead 54-year-old boss, Hervé Cornara, whom he knocked unconscious, strangled and then decapitated just before reaching the factory. Salhi attempted to blow up the factory by ramming several gas cylinders, causing an explosion. He also tried to open canisters containing flammable chemicals before being subdued. Salhi had made regular visits to the factory, so he was known to employees at the site.

French police opened a file on Salhi in 2006, over suspected links with a radical Salafist group, but it was not renewed in 2008. In 2012, he was involved in an anti-Semitic attack on a Jewish teenager on a train travelling from Toulouse to Lyon. Salhi was also in regular contact with the French jihadist Sebastian Yunis, known to have left for Syria to join ISIS.

In December 2015, after attacks at other locations in Paris, first with the Charlie Hebdo and kosher supermarket attacks in January, then with the devastating slaughter at cafés, a concert hall, and a stadium in November, showed that the police had lost track of many known and suspected terrorists in France and Belgium, about 70 airport employees with access to planes on the ground reportedly had their “red badges” lifted because they fell under police suspicion. And in years past, more quietly, police have broken up several criminal networks among baggage handlers with radical Islamist connections.

The United States has registered several cases of insider threat to civil aviation.

On Sept. 5, 2019, Abdul Alani, was arrested in Miami and charged with trying to damage an American Airlines aircraft. In July he used his access to the back side of the Miami airport terminal to drive up to a Boeing 737, open a compartment below the cockpit, and glue a piece of foam inside navigation equipment in such a way that pilots wouldn’t be able to tell how fast or high they were flying. The blockage triggered an alert when pilots powered up the plane, and they canceled the takeoff. Alani, born in Iraq and a U.S. citizen since 1992, passed the vetting process run by the Transportation Security Administration. There was no criminal history, no other outward signs of problems.[3]

In 2013, a technician with access to the tarmac was arrested as he tried to plant what he thought was a bomb at the airport in Wichita, Kansas. He had told an FBI undercover agent that he wanted to carry out a jihad for Al Qaeda.

Incidents of insiders sabotaging planes are considered extremely rare, although the Federal Aviation Administration does not track them and has no numbers. In 2015, the inspector general of the Homeland Security Department found that TSA failed to identify 73 aviation workers with security badges who should have triggered terrorism-related red flags. The reason: TSA wasn’t authorized to get all terror-related information from other federal agencies. After an outcry, TSA got more access.

But the jihadist arena is not the only threat, as is proved by radical right-wing insiders in military ranks in Europe.

In September 2018, seven men were arrested in Chemnitz, the east German city that was the scene of neo-Nazi riots in August, on suspicion of forming a far-right terror cell and planning violent attacks on politicians and immigrants. The men, all German nationals aged between 20 and 30, tried to obtain semi-automatic weapons and were planning to carry out a terror attack. They formed an extremist group under the name “Revolution Chemnitz.” The German press described the arrested men as planning a “far-Right revolution.” Five of them carried out a “dry run” attack on immigrants in central Chemnitz on September 14, armed with glass bottles, knuckle-dusters and electric stun guns.[4]

Germany's Military Counterintelligence Service (MAD) has classified about 200 Bundeswehr soldiers as right-wing extremists since 2008, according to a report published by the daily Mitteldeutsche Zeitung. The Green Party lawmaker and spokesperson Irene Mihalic, claimed that the recruitment of more than 20 right-wing extremists per year poses a serious challenge to domestic security.[5]

The Bundeswehr has come under increased pressure from the government to deal with members of far-right movements after an army lieutenant identified as Franco A. was discovered in April 2018 leading a double life as a Syrian refugee and planning a terrorist attack.

In September, the MAD said that it had recorded 286 new cases of right-wing extremism in Germany's military. But MAD President Gramm told lawmakers that after the suspension of mandatory military service in 2011, the number of right-wing cases decreased significantly.

In the German city of Tübingen, prosecutors launched in 2017 a probe into allegations of right-wing extremist behavior among the Special Forces Command, the country's elite military troops. After one year of investigations, taz reporters’ research led the conclusion that in many parts of Germany, but also in Switzerland and Austria, groups had been formed that tried to establish what could be seen as a state within a state. Members of these groups are policemen and soldiers, reservists, civil servants and members of intelligence services. Once they receive a sign, once “Day X“ has arrived, they wanted to be ready to take up arms. That “Day X“ was discussed frequently in their chat-groups. The German news magazine Focus called it an “Underground Army”.[6]

The fact that groups like these grew in autumn 2015 is certainly no coincidence. It is the time when the migration policy of Germany became a central national topic of debate, no lesser so inside these chatgroups. Members started to discuss, how to fight the official German migration policy.

The manifesto of Stephan Balliet, who attacked the synagogue on 9 October 2019 in Halle, Saxony-Anhalt, Germany, and killed two innocent citizens in his rampage, shows that he acted out of hatred for refugees, Muslims, Jews and socialists. He learned to handle weapons during his six-month military service in the German armed forces. There are several posts under his Facebook account with one posted on March 29th, 2017 showing him clad in a US military uniform with his name embroidered. It will be of interest if the investigation will discover if he had contacts with any military right-wing network.[7]

An investigation by the nonprofit news organization Reveal, which is run by the US Center for Investigative Reporting, has found that hundreds of active and retired police officers and law enforcement personnel in the United States are congregating in private Facebook groups where they engage in open racism, Islamophobia, and even lend support to violent, anti-government groups. After the Reveal report, more than 50 departments have reportedly opened internal investigations. At least one officer has been fired for violating department policies as a result of participating in these groups, some of which bear names like “White Lives Matter” and “Death to Islam Undercover.”[8]

Some Facebook groups surveyed by Reveal were associated with anti-government and militia movements, like the Oath Keepers. 150 of the 400 or so officers that it identified as belonging to these groups were part of that more extreme end.

The issue of the prevention of radicalization has become lately a central task in the security policy of the European Union and dozens of national and international projects are involved in this struggle. The law enforcement and intelligence agencies will need to invest a special effort to reduce the insider threat.


A shorter version of this article was published in the Jerusalem Post on October 25, 2019

[1]  Henry Samuel, “France probes security agency 'threats' after police killer with high-level clearance revealed as Islamic 'radical',” The Telegraph, October 6, 2019.

[2]  Tangi Salaün and Marine Pennetier, “After knife rampage by member of police staff, French cops on alert for more radicalized colleagues,” Reuters, October 11, 2019.

[3]  “Charge against airline mechanic highlights ‘insider threat,’” Associated Press, September 21, 2019.

[4]  Justin Huggler, “German Right-wing militants held over anti-migrant 'terror' cell,” The Telegraph, October 1, 2018.

[5]  “German military: 200 soldiers classified as far-right extremists since 2008,” DW, October 23, 2017.

[6]  “Hannibal’s Shadow Army,” Taz, December 13, 2018.

[7]  “Who is Stephan Balliet? Halle Synagogue shooting; Bio, Wiki, Age, Family, Victims, Background, Facebook, Twitch Video, Arrest,” GlobIntel, October 26, 2019.

[8]  Nick Statt, “Hundreds of active and former police officers are part of extremist Facebook groups,” The Verge, June 14, 2019.


Download Full Publication Download