This story originally appeared on ProPublica

After assembling suicide bomb vests for the attacks that slaughtered 130 people in Paris last November, Najim Laachroui went underground in his native Brussels.

The 24-year-old explosives expert wasn't just hiding from the biggest manhunt in Europe's recent history. He was plotting. In a dingy apartment converted into a bomb factory, Laachroui exchanged a series of messages in French with Abu Ahmed, a shadowy commander in the Islamic State based in Syria.

If law enforcement agencies had intercepted the communications, they would have been immediately alarmed. Laachroui asked militants in Syria to test chemical mixtures so he could assemble powerful bombs. He discussed his hopes to strike France again and disrupt a soccer championship there. He reported that he and half a dozen other fugitives from the Paris attacks had split up among three safe houses, according to Belgian and French counterterror officials.

Although US and European spy agencies were scouring the Internet for any trace of Laachroui, they failed to intercept those exchanges. The reason, US and European counterterror officials say: during Laachroui's four months on the run, he and Abu Ahmed communicated through Telegram, an encrypted messaging application, and other widely available tools for secure communications.

On March 15, Belgian police raided a safe house and killed another leader of the terrorist cell in a gunfight. A worried Laachroui sent a message to Abu Ahmed reporting that the raid had cost the plotters the stash of ammunition for their AK–47 rifles, according to Belgian and French counterterror officials.

"The original plan at the airport was for them to do an attack more like Paris: shoot a lot of people first, and then set off the bombs," a Belgian counterterror official explained in an interview in April. "But they didn't have ammo because it was left behind in the safe house. Laachroui says: ‘We don't have chargers for our guns. What do we do?' They were told to go ahead and attack just with bombs."

On March 22, they did just that. Laachroui and two other suicide bombers killed 32 people at the airport and at a subway station in Brussels. Afterward, investigators found a laptop computer that helped them reconstruct Laachroui's encrypted audio and text exchanges with his commander in Syria, according to European counterterror officials.

The communications were described by European and US counterterror officials to ProPublica, which is preparing a documentary about terrorism in Europe in collaboration with the PBS program Frontline. ProPublica interviewed counterterror officials in Europe and the United States, some on condition of anonymity, and reviewed intercepted conversations documented in European court cases.

Taken together, the voices of the Islamic State offer insights into the day-to-day workings of an organization that has carried out lethal attacks in Baghdad, Bangladesh, and Turkey in the past two weeks.

The culture of ISIS mixes the centralized control that characterized al-Qaeda with a more freewheeling approach that gives its operatives considerable latitude. The group's use of digital propaganda to inspire "self-radicalizing" terrorists has drawn attention with attacks on US soil in San Bernardino and Orlando. But the communications collected in Europe show the group provides direct long-distance instructions to operatives it dispatches from its base in Syria, and they rely heavily on that guidance.

The European communications also clearly establish the importance of encryption to ISIS operations.

"We are dealing with a challenge right now: New technologies that enable encryption and allow them to be fairly confident that they are communicating in a way that can't be detected," a senior US intelligence official said. "They know how to communicate securely. Often we are inhibited: We know the fact of the communications taking place without knowing the content."

In April, Italian police overheard a senior figure in Syria urging a Moroccan suspect living near Milan to carry out an attack in Italy, according to a transcript. Although the voice message had been sent through an encrypted channel, the Moroccan played it back in his car, where a hidden microphone recorded it.

In the message, the unidentified "sheik" declared: "Detonate your belt in the crowds declaring Allah Akbar! Strike! (Explode!) Like a volcano, shake the infidels, confront the throng of the enemy, roaring like lightning, declare Allah Akbar and blow yourself up, O lion!"

The suspects exchanged recorded messages over WhatsApp, an encrypted telephone application that is widely used in Europe, the Arab world and Latin America. FBI Director James Comey and other counterterror officials have publicly expressed concern about extremists in the United States using such techniques to elude monitoring.

"We'll be monitoring a couple of guys in an Internet chatroom," a former FBI counterterror official said in an interview. "Then you'll see one of them says: ‘OK, reach out to me on WhatsApp.' At that point, we can't do anything."

Executives at WhatsApp and Telegram defend encryption as a vital shield to privacy. Reached for comment last week, a spokesperson at WhatsApp said the company complies with US laws requiring cooperation with law enforcement agencies. The spokesperson cited a statement by executives in April when WhatsApp implemented "end-to-end" encryption that will conceal the content of users' communications even from the company itself.

"Encryption is one of the most important tools governments, companies, and individuals have to promote safety and security in the new digital age," said Jan Koum, the company's founder, in a blog post in April. "While we recognize the important work of law enforcement in keeping people safe, efforts to weaken encryption risk exposing people's information to abuse from cybercriminals, hackers, and rogue states."

(Facebook, which owns WhatsApp, announced Friday that it would add end-to-end encryption for some photo and text messages on its Messenger application.)

Telegram did not respond to a request for comment for this article last week. But company executives have publicly addressed concerns about encryption by saying that technology comes with an inevitable dark side. The company says it has shut down more than 660 public channels on its application that were being used by the Islamic State.

Intelligence officials say the Islamic State's failure to launch Paris-style attacks in the United States reflects differences in both geography and demography. American Muslims are less radicalized and less numerous than those in Europe, and US border security makes it harder for would-be terrorists to enter the country, according to Western counterterror officials.

In Europe, the Islamic State has found support in large and restive Muslim communities, especially among criminals who radicalize more rapidly today than previous generations of hoodlums-turned-jihadis. Investigators say intensified Western military pressure in Iraq and Syria has prompted the group to order European recruits to strike immediately rather than make the pilgrimage to the caliphate.

"In the context of the current strategy of the Islamic State, it's clear that their focus is causing casualties here," said Claudio Galzerano, commander of a counterterrorism unit of the Italian police.

The ISIS strategy toward the West has evolved since the Islamic State conquered a swath of territory in Syria and Iraq and declared the caliphate two years ago, causing thousands of militants to flock to Syria.

Previous generations of aspiring jihadis passed through a series of filters as they journeyed to al-Qaeda training camps in South Asia, often with a first stop at radical mosques in London. This selective, secretive approach allowed al-Qaeda to vet prospective holy warriors and detect attempts at infiltration by intelligence services.

By contrast, the flow to Syria has been larger, faster, and less security-conscious. Taking advantage of Europe's proximity and ease of travel, fighters who rushed to Syria posted photos of themselves online brandishing guns. Their ranks included criminals and thrill-seekers with little religious knowledge, according to Marc Trevidic, a veteran French counterterror judge.

The Islamic State "has accepted for strategic reasons, because it wanted to impose itself on other groups in the region, the recruitment of anyone," Trevidic said. "Methods will be created afterwards to check that… they are not spies, etcetera, but initially there are no filters."

An Italian investigation begun in 2014 documented that hectic period. Tracking jihadis from Italy, police intercepted the cell phones of senior figures in Turkey and Syria, according to a 44-page report by a Milan investigative magistrate dated June 12, 2015. A Turkish phone was used primarily by Ahmed Abu al Harith, "a significant member of the terrorist organization with the role… of coordinating volunteers arriving in Turkey and headed to join the Islamic State," the report says.

Monitored in late 2014 and early 2015, Ahmed Abu al Harith and fellow coordinators spoke multiple languages with callers from 22 countries including Afghanistan, Saudi Arabia, Georgia, San Marino, and Sweden.

They explained "concrete rules for joining the Islamic State already described on the Internet in a manual titled ‘Hijrah [Pilgrimage] to the Islamic State—what to bring, whom to contact, where to go,'" according to the Italian report.

The coordinators didn't use encryption or coded language. But they banned recruits from traveling with "latest-generation mobile devices" in order to "avoid being located" by spy agencies. The Islamic State wanted recruits to leave behind smartphones, tablets, and other devices with existing trails of activity that make them easier to trace and use new, disposable cell phones instead, the report says.

Some recruits were less than sophisticated about the directives.

On January 4, 2015, an exasperated coordinator repeatedly explained to a befuddled caller with a Lebanese accent that he could only bring a basic cell phone to Syria, according to a transcript.

"The important thing is that when you arrive in Turkey you have a small cell phone to contact me," the coordinator said. "Don't bring smart phones or tablets. OK, brother?"

For the fourth time, the recruit asked: "So we can't have cell phones?"

"Brother, I said smart phones: iPhone, Galaxy, laptop, tablet, etcetera."

Sounding a bit like a frustrated gate agent at a crowded airport, the coordinator added: "Each of you can only bring one suitcase. If you come alone, just bring one suitcase. That is, a carry-on and one suitcase."

"I didn't understand the last thing, could you explain?"

"Brother, call me when you get to Turkey."

In Syria, new arrivals were interviewed by Islamic State militants seated at computers, according to Western counterterror officials. The militants asked a checklist of questions including blood type, mother's name, level of religious education, and preference for becoming a "warrior" or a "martyr," according to copies of Islamic State intake forms obtained by ProPublica. The authenticity of the documents was confirmed by US counterterror officials.

Although the culture of the Islamic State is repressive and bureaucratic, the reality on the ground can be rather anarchic. The restrictions on high-tech devices described in the Italian investigation were by no means uniformly imposed or obeyed. Militants in the self-styled caliphate have access to computers, smart phones, and social media. Some have posted a barrage of messages and images, including videos of atrocities.

In response, leaders of the Islamic State have told foreign fighters to curtail their activity on social media because it exposes them to eventual prosecution back home or to being targeted in Syria. The use of social media has continued, however, according to European counterterror officials.

In fact, the cacophony of voices from Syria has been crucial to recruitment.

"In contrast to what has happened with other conflicts, the recruitment and the propaganda aren't just in hands of the public communications apparatus," said a counterterror chief of the Spanish police. "Each fighter has a phone and narrates his day-to-day life, his blog … A lot of these terrorists have circles of associates in Europe because they came from there, so this is effective publicity."

Tapping into such communications, Italian police gained insight from their investigation of a family of Muslim converts from the Milanese suburb of Inzago.

Maria Giulia Sergio was 28. In September of 2014, she married an Albanian extremist she barely knew so they could join the Islamic State, according to investigators. The couple traveled with his mother to the Syrian city of Sed Forouk and met up with Albanian relatives living there, including children. The husband's brother died in combat, according to the report.

The newlyweds encountered "numerous daily obstacles" to staying in touch with people back home because of "rigid rules imposed by the Islamic State as well as the objective technical difficulties, in a country devastated by years of civil war," the report says. "This had a positive impact on the investigations because it had the practical effect of multiplying calls among relatives" in Italy and Albania when they heard from the militants.

Sergio talked via Skype because the suspects believed it was "more secure," the report says. Police intercepted the conversations nonetheless. Sergio described her husband's stint in a training camp in Iraq. She talked about child care, Koranic classes, decapitations and a stoning, and implored her family to make the "hijrah," or pilgrimage to Syria.

"I am speaking to you in the name of the Islamic State," she said. Scolding her father for remaining in his job in Italy, she said: "It makes no sense for you to work for them. They are the ones who must be our slaves."

In April of last year, the parents announced they would join her. The father asked if he should bring his driver's license and if he could buy a car in the "Caliphate," according to the transcript.

Police arrested the suspects before they could depart.

Meanwhile, authorities across Europe struggled to intercept a smaller flow of militants traveling in the opposite direction.

Western intelligence officials estimate that the Islamic State dispatched between 60 and 180 operatives to attack targets in Europe. The strategy appears to have been to overwhelm the security forces with sheer numbers. Even if most of the strikes failed, something would eventually succeed. The results were graphically evident in France, where authorities foiled 11 attacks in 2015.

Officials say the threat has changed since the days of al-Qaeda. Osama bin Laden's group had the flexibility common to Islamist terror networks, often developing plots based on the initiative, expertise, and availability of recruits who reached its secret compounds in Afghanistan and Pakistan.

Al-Qaeda created a team to oversee attacks overseas. The chief plotters were Middle Easterners or Pakistanis, and they guided operatives to targets with instructions via phone and e-mail. US counterterror agencies identified external operations chiefs and eliminated a series of them with drone strikes and captures.

Today, the counterterror community is still mapping out the Islamic State's leadership, especially those involved in foreign plots, according to the senior US intelligence official.

"The structure that promotes attacks is wider and deeper, but to some degree also more autonomous, than what we saw with al-Qaeda," the official said. "It isn't the case where we can home in on individuals and have a fair degree of confidence that if we neutralize them we will have had a considerable impact on the threat. That's not the situation with ISIS. We had a fairly comprehensive view of the structure of al-Qaeda … With ISIS, we don't have an exact picture. It's an intelligence collection challenge that we are working hard to address."

The Islamic State's top echelons are dominated by Gulf Arabs, Syrians, and Iraqis, including former military and intelligence officers. Foreign fighters serve in units known as "katibas" organized by nationality and language. Large Francophone katibas field hundreds of French and Belgians, many of North African descent, and thousands of Moroccans and Tunisians. Senior foreign fighters have the resources of a quasi-state at their disposal: money, technology, identity documents, training facilities. But they are also given considerable autonomy to develop plots, officials say.

"There is… leeway to foreign fighters and operatives to choose targets and methods on turf they know best," the senior US intelligence official said. "The foreign fighters know what the organization wants to see happen and they act on it."

The attacks on Paris in November briefly made Abdelhamid Abaaoud, a 28-year-old Belgian ex-convict, an internationally known leader of the external operations unit. He participated in the massacre and died in a police raid days later in the gritty suburb of Saint Denis. Yet some investigators now believe his stature within the Islamic State has been overstated.

"To me he was an average leader," said Judge Trevidic, who led investigations of plots in which Abaaoud surfaced. "Have you ever seen a general on the front in Saint Denis? That is all right for a lieutenant, a captain, but not for people above."

Based in Syria, Abaaoud selected, trained and deployed jihadis to Europe in 2014 and the first half of 2015. In addition to guns and grenades, he taught trainees about secure communications—encrypted applications such as Telegram, WhatsApp, and Truecrypt—and set up protocols to contact them when they were in place.