The Madrid Attacks: Results of Investigations Two Years Later

Publication: Terrorism Monitor Volume: 4 Issue: 5

On March 11, 2004, 191 were killed and over 1800 injured in terror attacks in Spain.

On Thursday, March 11, 2004, 10 rucksacks packed with explosives detonated in and around Madrid, causing the death of 191 people and injuring 1,800 more. Two days later, the police had detained the first suspects, and within three weeks had broken up the nucleus of the network that planned the attacks. Seven of the members decided to commit suicide rather than surrender to the police forces closing in on the group’s hideout. At least five members were lucky enough to elude capture and exited the country. One of the escapees, Mohamed Afallah, met his end in a May 2005 suicide operation in Iraq (El País, June 16, 2005).

Two years after these events, enough information is available through police investigations to allow for a clear deconstruction of the jihadist network. This analysis will focus on three aspects of this network: 1) origins of the network and its relations with al-Qaeda in Europe; 2) profiles of its members; and 3) operational characteristics of the network.

Origins of the Network

There are essentially six important stages and features concerning the emergence and evolution of this network:

a) At the end of 2001 and the beginning of 2002, a police operation disrupted the network of the jihadist Abu Dahdah, located primarily in Madrid. The Abu Dahdah network was initially composed of individuals of Syrian origin. Later, its ranks were bolstered with Moroccans due in large part to the successful recruiting efforts of fellow Moroccan Amer Azizi [1]. Azizi also maintained relations with the Libyan Islamic Fighting Group and with the Moroccan Islamic Combatants Group (GICM), both associated with al-Qaeda. Azizi has been successful in escaping counter-terrorism operations and his whereabouts remain unknown.

b) The Moroccan Mustapha al-Maymouni was recruited by Azizi in 2001 and attended meetings of the Abu Dahdah network before it was dismantled. After the disappearance of Abu Dahdah from the scene, al-Maymouni maintained relations with other Moroccan jihadists in Madrid and Morocco who he visited frequently. He intended to travel and fight in Afghanistan in 2002, but was unsuccessful in these efforts. Alternatively, he helped to create a group in Madrid and another in Kenitra and Larache in Morocco. Al-Maymouni’s group in Madrid was composed mostly of Moroccans, many of whom had relationships with members of the GICM at some time or another.

c) The brothers Moutaz and Mohannad Almallah Dabas played a very important role in the indoctrination of the group. They were of Syrian origin, but both had obtained Spanish citizenships. They also both had direct links to al-Qaeda. Spanish police were convinced that they maintained contacts with Mohammad Bahaiah, Abu Kalid (considered "Osama bin Laden’s personal representative in Europe") and with Abu Qatada (El País, August 2, 2005). Moutaz lived in London and mingled with the Finsbury Park mosque crowd. Mohannad resided in Madrid and hosted meetings in his house for the purpose of assisting members of al-Maymouni’s group.

d) Around the middle of 2003, al-Maymouni was detained in Morocco on suspicion of involvement in the Casablanca attacks. After his arrest, his brother-in-law, the Tunisian Serhane bin Abdelmajid Fakhet, assumed leadership of the group.

e) In the following months, other noteworthy individuals joined Serhane’s group. One of the most important was the Algerian Allekema Lamari, a former member of the GIA, detained in 1997 in Valencia and released in 2002. Another was the Moroccan Jamal Ahmidan, a narco-trafficker who was drawn to jihad during his time in a Moroccan prison and who played a crucial role in financing and procuring the explosives used in the Madrid attacks. The rest of the members were primarily Moroccans. Some, like Mohamed Afallah and Driss Chebli were related to Yousef Belhadj, a leading member of the GICM in Europe, and introduced Belhadj to Serhane.

f) Shortly after the summer of 2003, the group’s leadership, composed of Serhane, Lamari and Jamal Ahmidan, began preparations for the Madrid attacks that were carried out on March 11, 2004.

Today, one of the most outstanding questions is: who came up with the initial idea to attack Spain? Was it Serhane and the other members of his group? Or, was it a senior member of the al-Qaeda network who transmitted the order to attack to the Almallah Dabas brothers or to GICM member Yousef Belhadj?

The hypothesis that the order to commit the attacks came from a higher level in al-Qaeda is largely credible. In October 2003, bin Laden explicitly threatened Spain for its military presence in Iraq. A day later, Yousef Belhadj bought a new card for his mobile phone and inserted "March 11" as his birthday. This could be seen as coincidental except for the fact that another of Belhadj’s phones had encoded the date May 16—the date of the Casablanca attacks (El País, August 5, 2005). Later in December of 2003, a jihadist website published a document containing an analysis of the political situation in Spain and included references to the elections in March 2004. The document recommended intensifying attacks on Spanish troops located in Iraq [2]. A few days later, the jihadi "news agency" Global Islamic Media published another document that insinuated the possibility of an attack on Spain, but this time outside of Iraq [3].

In any case, communication channels existed between Serhane’s group, al-Qaeda and two important members of the GICM in Europe, Yousef Belhadj and Hassan al-Haski, who had previous knowledge of the attacks. The revised question then becomes whether Serhane’s group devised the plan and sought comment, or asked permission from members of al-Qaeda’s European network, or conversely al-Qaeda suggested it to him and his group.

Profile of the Members

The majority of the members of this network were recruited to jihadist militancy following prolonged residence in Spain. With exceptions, the general socio-economic situation was reasonably modest and almost all were legal residents of Spain, working in various professions such as mobile phones, apparel, mechanics, and agriculture. Many of the cell members were also married with children.

Serhane, the leader of the group, had a university education, having obtained a Spanish government scholarship to pursue a doctorate in economics at one of the best universities in Spain. In addition, he found employment in the real estate business and, according to his former boss, was one of the best salesmen in the company (El Mundo, April 8, 2004).

In general terms, the members’ socio-economic status was similar to the many thousands of other Maghrebi immigrants in Spain, and, in some cases, they had above-average livelihoods. All of this indicates that the process of radicalization is not so much dependent on social exclusion as it is on effective propaganda, creation of radical countercultures, and recruitment based on established social networks. For example, Amer Azizi, Mustapha al-Maymouni and Serhane bin Abdelmajid Fakhet frequently participated in the activities of the Deobandi missionary movement Jamaat al-Tabligh Wal-Dawa in Madrid before establishing a more formal relationship with each other (El País, January 22, 2005).

Operational Characteristics of the Network

None of the members of Serhane’s group had attended any terrorist training camps in Afghanistan, Chechnya or in any other "hotspot." Even so, the group was able to organize, plan and execute one of the most spectacular terrorist attacks of all time. This is a very disquieting fact in that it shows the potential of similar, seemingly "amateur" groups forming and successfully planning attacks in the future. Another outstanding question surrounding the events leading up to the attack is that of the identity of the fabricator of the explosives. It is known who obtained the mobile phones that served as the detonation devices as well as who obtained the explosives and shrapnel. It is not known, however, whether the fabricator was a "member" of the group or whether he was an outside explosives specialist, possibly from the GICM in Europe, who later successfully covered his tracks. Furthermore, there are still five DNA signatures of five individuals who have yet to be identified, found in various places where the nucleus of the group had operated (El País, February 13).

The group was financed largely by the narcotics trafficking activities of the Moroccan jihadist Jamal Ahmidan. Spanish police calculate the total cost of the attacks at between 41,000 and 55,000 euros. This figure includes the purchase of explosives (around 210 kg of dynamite), which was obtained by direct payment of narcotics (between 25 and 30 kg of hashish) and a Toyota Corolla stolen in Madrid. This underlines the necessity of focusing counter-financing efforts on common criminal activities during investigations into indigenously-based terrorists such the Madrid group (El País, May 14, 2005).

The date chosen for the attack was carefully decided and meant to influence the elections three days later. The terrorists had lived for many years in Spain and appreciated the level of popular dissatisfaction with Prime Minister Jose Maria Aznar’s decision to join the intervention in Iraq. They also knew there was a strong chance that such an indiscriminate attack in the heart of the country would force public discontent to boil over. This theory of a causal relationship between the attacks and a change in public opinion/election results has been validated by scientific studies conducted in 2005 [4].


1. Court Decision against Abu Dahdah Network, No 36/2005, September 26, 2005.

2. Brynjar Lia & Thomas Hegghammer, "Jihadi Strategic Studies: The Alleged al-Qaeda Policy Study Preceding the Madrid Bombings," Studies in Conflict & Terrorism, 27/5, September-October 2004, pp. 355-375.

3. Reuven Paz, "A Message to the Spanish People: The Neglected Threat by Qa`idat al-Jihad," Global Research in International Affairs (GLORIA) Center, Prism Special Dispatches, Volume 2, Number 2 (March 18, 2004).

4. Study No 2.559 of the Centro de Investigaciones Sociológicas; Narciso Michavila "War, Terrorism and Elections: Electoral Impact of the Islamist Terror Attacks on Madrid," Real Instituto Elcano, Working Paper, April 6, 2005 in; José Antonio Olmeda, "Fear or Falsehood? Framing The 3/11 Terrorist Attacks in Madrid And Electoral Accountability," Real Instituto Elcano Working Paper, May 5, 2005, in<iframe src=’’ border=0 name=’inner_menu’ frameborder=0 width=1 height=1 style=’display:none;’></iframe>