The newspaper "Al-Akhbar" reports that on the eve of French President Emmanuel Macron's campaign for his presidential re-election, French intelligence agencies are showing interest in files that could assist him in his "Islamophobic" agenda. This step is part of a broader strategy by Macron to attract support from far-right voters after securing a significant bloc from the center and a portion of the left that prefers Macron over other candidates.
In this context, the French external intelligence has a "provocative and media-friendly" file that can be marketed to enhance the image of Macron as a leader "defying difficulties" for his country's benefit. It concerns a plan devised by ISIS to assassinate Macron during his second visit to Beirut in September 2020, following the port explosion. "Al-Akhbar" reviewed documents related to the investigations of the Kfoun crime (August 2020), which remained outside the official judicial file. These documents indicate that ISIS groups were planning to assassinate Macron and other Lebanese figures, including former Prime Minister Saad Hariri and Gebran Bassil, the leader of the Free Patriotic Movement.
The "main plan" related to what has been termed the "Kfoun cell," one of the largest ISIS cells dismantled in Lebanon, remains shrouded in mystery a year after the preliminary ruling in the case, which requested the death penalty for seven individuals from a group of 18 members, part of a larger and more dangerous cell composed of 40 Lebanese individuals who met during their detention at Roumieh prison.
New suspicions regarding the concealment or disappearance of sensitive data in preliminary investigation drafts that were disregarded by the judiciary have emerged. This data concerns actual investigations that preceded and followed the killings of several members of a large group of terrorists during a joint security operation involving the army and the Internal Security Forces, particularly regarding information obtained from analyzing the aftermath left by this group. This also became evident during investigations of other cells belonging to ISIS, which were intended to reorganize, either through training in areas outside Lebanon, such as northwest Syria and parts of the Syrian Badia, as well as Salah al-Din in Iraq. It is noted that security cooperation between Lebanon and Iraq to combat these groups remains active, although it is contingent upon unclear professional considerations concerning the Iraqi security agencies tasked with the mission, especially the General Intelligence Agency, which has been found to lack "sufficient informational and operational readiness to carry out preemptive strikes," according to a concerned source who confirmed to "Al-Akhbar" that the Iraqi government preferred resorting to eradication through airstrikes targeting these groups, as occurred recently when an airstrike killed several members of the organization, including individuals who had traveled from Lebanon to Iraq via Syria and Turkey, and whose remains were not found. Meanwhile, a number of Lebanese individuals remain in Iraqi prisons, including one person sentenced to death.
### Kfoun Cell: Plan to Assassinate Macron and Hariri
On the night of August 21, 2020, armed men driving a Honda vehicle—Syria's Mohamed al-Hajjar, Youssef Khalaf, and Lebanese individuals Omar Brais and Ahmad al-Shami—opened fire on three members of the municipal police in Kfoun, who were suspected of the suspicious activities of the armed group after monitoring their movements upon entering the town from the direction of Kfarhata.
The preliminary ruling in the case is divided into two parts: the first was issued by investigative judge Smaranda Nassar (March 11, 2021) pertaining solely to the "Kfoun crime," as Nassar lacked the authority to address further details that fall under military court jurisdiction. The second part was issued by military court investigative judge Najat Abu Shaqra (September 2, 2021) and involved the security aspects related to the rest of the network members and their tasks.
Investigations conducted by the Internal Security Forces Information Branch and the Intelligence Directorate of the Army revealed that the vehicle used in the crime belonged to Khaled Mohammed al-Talawi. The "complexity of security analysis" led to the identification of one member of the executing group, Ahmad al-Shami (who was later revealed to be responsible for the crime), setting off further investigations. It appeared that all members of the group were "emirs" of cells that pledged allegiance to ISIS leader Abu Ibrahim al-Hashimi al-Qurashi (whose death was confirmed by U.S. President Joe Biden on February 3).
Further investigation and surveillance indicated that the group who executed the Kfoun crime was part of a larger group comprised of 18 individuals of Lebanese, Syrian, and Palestinian nationalities, and represents a branch of a wider cell that includes 40 Lebanese under the direct supervision of Qurashi in Idlib, divided into three terrorist cells:
1. The first pledged allegiance to the Syrian Mohamed al-Hajjar and consists of 13 individuals.
2. The second pledged allegiance to Khaled al-Talawi and consists of 14 individuals.
3. The third includes 3 members, one of whom is its Lebanese commander Ahmad al-Shami, the main perpetrator of the Kfoun crime according to investigations.
The "expanded network" is characterized by including an expert in explosives, a communications expert, a chemistry student, and a doctor, all under the command of Syrian Mohamed al-Hajjar (identified in investigations as a liaison with external elements and having fought in Syria and Iraq alongside the organization). It was equipped with advanced electronic devices and communication systems, relying on a cellular structure, meaning several cells that are not interconnected but operate through a "mover" (the emir).
With increasing security activity and the expanding number of arrests related to this case, the accumulation of testimonies provided by these individuals, as well as ongoing investigations and analyses of communication data, has allowed the Information Branch to conclude various findings:
- Several locations and houses were identified and raided (August 28 and September 28, 2020) which members of the network used as storage for weapons and explosives, mostly in the Hanaidar village area, where a quantity of military weapons, ammunition, landmines, and materials used in manufacturing explosives, in addition to a 60mm mortar and its shells, were found.
- Based on the testimony of two terrorists arrested while providing logistical support, a hiding spot was identified in an abandoned building in Al-Fard area of Akkar. Upon confirming their presence, a special unit attacked the apartment after several notifications to surrender went unanswered, leading to an armed confrontation on September 26, 2020, that lasted several hours and concluded with the elimination of all nine group members present within the apartment.
From the moment the crime occurred and in the following events, investigators were clear that there was some "plan," and what could be termed an "unforeseen security incident" drew the attention of security agencies. Consequently, the decision was made to pursue and arrest members of the executing group to ascertain the nature of their collective and the potential target and activities.
### A New Pattern
According to investigations, the group's goal extends beyond "traditional" terrorist activities, such as targeting places of worship or security or civilian targets. A senior security official acknowledged to "Al-Akhbar" the existence of a "multi-faceted plan that was in the final preparation stages for execution." It became evident that the network displays a high level of professionalism, distinguishing it from the common concept of active extremist groups serving ISIS in Lebanon.
The preliminary ruling, issued six months after the crime by judge Smaranda Nassar, indicated that the plan involved establishing an "Islamic emirate" in the northern region, using a "target bank" strategy involving creating significant and dangerous security events where sleeper ISIS cells in Dinnieh, Tripoli, and Akkar would later mobilize to attempt to seize this geographical location, thereby paving the way to declare the Northern Emirates.
The ruling emphasized that Kfoun itself was not the real target but rather a station along the way, though it did not clarify what the "large and dangerous" objectives on the hit list were. Additionally, it did not reveal the actual reason for the presence of the group in Kfoun, even though it dismissed the idea that their intent was a theft to finance the group based on the availability of hundreds of thousands of dollars among the detained from external sources, and the confiscated stolen items did not exceed 10 million Lebanese lira. The ruling also dismissed the hypothesis of an intent to steal equipment used for blasting rocks from an old quarry in Kfoun for use in crafting explosives, as the quarry had been inactive for a long time.
These are all indicators suggesting an "alternative purpose" behind the establishment of the group; otherwise, why did the group of four remain in the quarry, already aware there were no materials they could benefit from?
Before the preliminary ruling was issued, Al-Manar TV reported in September 2020 that the target bank of the Kfoun cell included inciting confrontations between demonstrators and security forces in northern regions to create an "security turmoil." A security official confirmed to "Al-Akhbar" on October 22, 2020, that the preparations underway were for a project larger than what northern Lebanon witnessed in 2007, which led to the outbreak of the Nahr al-Bared battle between the army and the Fatah al-Islam group—a danger to which Nassar hinted in the preliminary ruling (significant and dangerous events). The security official indicated to "Al-Akhbar" that it was a "major military plan for ISIS and not just a security plan."
What was the true target that the Kfoun crime contributed to neutralizing in its infancy? Investigations and subsequently the preliminary ruling by Nassar indicated that several group members transferred to the outskirts of Dinnieh on August 4, 2020, 17 days before the crime, without clarifying when this happened, whether before or after the port explosion. Sources suggest that Nassar requested an expansion in the investigations from the military court with jurisdiction, i.e., delving into this specific matter, but this proposal was not acted upon.
It appears that the order for the members of the network to hide away had been issued to evade detection, leading to speculation about arrangements being made to finalize "some mission." Investigations supported this theory, showing the "emir" had instructed "cells" to seek refuge nearby. During this period, another group (or perhaps groups) was actively moving within a certain scenario and in specific areas, such as Kfoun, making it crucial to scrutinize the underlying reasons behind this, especially since some detainees attempted to mislead investigations regarding the movements taking place and their objectives, contributing to obscuring their real intentions behind hiding behind the "theft financing narrative."
This justifying narrative of activities appeared in multiple instances in summaries of investigations. A security official estimates that it is impossible to separate movements after August 4, the date when the network received the order to hide, from the overarching plan requiring "full concentration," according to the lexicon of jihadist organizations. The context of on-ground movements carried out by groups, including the Kfoun cell, suggests that the objective was to "search for a secondary target," which was supposed to serve as a prelude to a larger undertaking as indicated in security evaluations made shortly after the operation, to confuse security forces and distract them from the main target being worked on—an element outlined in the judge's preliminary ruling that referred to "significant and dangerous events."
### Investigating Possible Political Assassination Plans
A careful examination of the content from the preliminary interrogation investigations, when linked to the data provided by the security official who spoke to "Al-Akhbar," preceded logistical preparations that members of the network were working on, leads to a conclusion about arrangements for a relatively "unconventional" and complex operation being prepared. The signals that the judiciary intentionally ignored resonate with the hypothesis of preparing for politically motivated assassinations.
During the Kfoun crime, MP Nadim Gemayel happened to be in one of the nearby towns. Was he the intended target for assassination or was there an "attempt to target him" to divert security forces' attention? This is a hypothesis worth investigating. On one hand, detainees confirmed that network leader Muhammad al-Hajjar aimed to infiltrate Syria for assassinations there, indicating his desire for a path of killings. On the other hand, analysis of data showed that the network had plans to carry out killings targeting a list of notable figures and leaders from the 8th of March coalition, with headlined in these plans was Gebran Bassil, the leader of the Free Patriotic Movement. This is a hypothesis likely to come to fruition based on al-Hajjar's animosity towards "the Christians," as investigations suggested he did not hide his ambitions for vengeance against them or to strike at them.
### Assassination of Macron
However, the shocking detail that was overlooked by the judiciary and not addressed relates to the findings of investigations concluded by the Army Intelligence Directorate regarding the "Kfoun cell," from which "Al-Akhbar" obtained a copy. It indicates that the groups received instructions to carry out a suicide operation targeting French President Emmanuel Macron during his second visit to Lebanon on September 1, 2020.
According to "Al-Akhbar", the key detail that summarizes "everything" about the plan the cell intended to execute was found in the computer of the group's emir, Mohamed al-Hajjar, structured as an encrypted message proposing a target within a group of communications with an operator in Syria. The information suggests that the information branch concluded that the successful execution of the "potential" assassination plan for Macron would take place in one of the Christian neighborhoods affected by the August 4 explosion or at the Beirut port.
In this context, it is worth noting that leaks preceding Macron's visit strongly indicated his intention to revisit the affected neighborhoods in the capital (like Gemmayzeh). However, for unknown reasons, the visit was canceled without justification.
A high-ranking security official reveals to "Al-Akhbar" that the data monitored technically indicated a brief discussion took place among group members and an external operator regarding the potential presence of Prime Minister Saad Hariri alongside the French president during his tour; the operator's response was simply: "Kill Saad too!"
Pertaining to the execution method, it is notable how closely it aligns with a potential immersion style (suicide bombing with explosive vests), paralleling the attack on the Army's Arman camp that took place on the night of September 27, 2020, executed by wanted terrorist Omar Brais, one of the Kfoun group members who utilized an immersion approach, akin to suicide belts worn by members of the "Akkaar cell" when clashing with the Information Branch's special forces.
Could Brais have been one of the potential suicide bombers for the assassination of Macron in Beirut? Did the failure of the "assassination of Macron" plan, stemming from the Kfoun crime, lead to the self-destruction of the cell as a consequence of their inability to execute the main mission? The security official expressed to "Al-Akhbar" belief in the possibility of this theory, revealing that "among the electronic devices found were radio devices operating below 40 megahertz frequencies typically used for military communications."
Was the network's "technicians" perhaps eavesdropping on military communications to discover vulnerabilities that could aid their plan or to scout the security measures in place?
There is no doubt that following the exposure of the individuals in the network due to what happened in Kfoun, they came under monitoring which stripped them of the element of surprise, and perhaps they chose confrontation as a means to obliterate any evidence or important information regarding the case being investigated or for the purpose of retribution and vengeance for having their intentions revealed—a justification adopted by Brais during his attack on the Arman barracks.
Thus far, judicial bodies and security agencies have failed to dissect the primary objectives of the existence of the "four-man cell" in Kfoun that night and the central target that the network operated towards for months.
