October 2015, Vienna, Austria.
For 18 months, the ISIS cell had been running what no one believed was possible, planting an asset inside Mossad.
Not someone watching from the outside, a man inside with access to names, offices, operations across Europe.
The planning chief had spent 18 months on the approach, the cover, the trust.
That night, he told his superiors the operation had succeeded.
Their man was in.
His name was Karim Haddad.
Except, Haddad had walked into a Mossad office before ISIS ever made contact, because ISIS had killed his brother in Liège, and he had sworn to make them pay for it.
ISIS believed Haddad was their weapon inside Mossad, the man who would tear it apart from within.
Haddad believed that with Mossad’s help, he would avenge his brother.
Both were certain.
Only one was right.
How did one man fool one of the most feared networks in the world for 18 months? What happens when an intelligence operation discovers its own intelligence was fake? And how do you destroy an organization from the inside when it thinks you are working for it? If operations like this one, double agents, intelligence traps, missions no government has ever confirmed, are what you watch this channel for, subscribe now and hit the bell.
Every story here
is real, and none of them ended the way anyone planned.
January 2014, Liège, Belgium.
The call came at 6:00 in the morning.
A police officer read from a prepared script.
There had been an incident involving an improvised device.
A person matching Youssef Haddad’s description had been identified at the scene.
Karim was asked to come to the Hôpital de la Citadelle as soon as possible.
Youssef Haddad was 26, a delivery driver, no political affiliations.
On the evening of January 9th, he had been on a side street off the Rue de la Cathédrale when a device went off nearby.
>> >> The target had been a Belgian state security vehicle parked outside a civic office.
The vehicle was empty.
The blast radius reached 30 m.
Three people were on the street.
Youssef was the only one who died at the scene.
The mortuary was a yellow brick building on the eastern edge of the city.
An attendant walked Karim down a corridor and asked if he was ready.
Karim said yes.
He was not ready.
The attendant lifted the sheet.
Karim stood at the table for a long time.
He did not cry.
He asked if he could see his brother’s personal effects.
They came in a sealed plastic bag.
A phone, a set of keys, a wallet, and a watch.
A thin silver Seiko with a cracked clasp.
Karim took it out of the bag.
He turned it over once.
He fastened it on his own wrist and did not take it off after that day.
Over the following 5 months, Karim attended the funeral, returned to work, and sat through a victim support session in Liège where a government representative explained that investigations were proceeding through proper channels.
Karim listened.
He did not speak.
He had spent 4 months reading court documents from French prosecutions of returned fighters, academic papers on terrorist network structure, journalism.
He cross-referenced and filed.
By the time he sat in that community room, one conclusion was clear.
ISIS was building an intelligence network in Europe.
They needed assets with access to Western security structures.
The profile they were working toward, documented grievance, logistics background, linguistic range, genuine vulnerability, was almost precisely the profile of Karim Haddad.
He had not yet decided to do anything about it.
That came 3 weeks later when a Belgian magistrate >> >> announced that three of the four people responsible for the Liège bombing had been acquitted on procedural grounds.
The fourth received a suspended sentence.
Karim sat in his apartment in Antwerp.
Then he started building a file.
September 2014, Tel Aviv, Israel.
He arrived on a tourist visa and behaved like a tourist for 1 day.
On the second morning, he took a taxi to the Kaplan Street district and found a coffee shop with a clear view of an office building across the street.
He had identified the building over 3 months, a reference in a Danish documentary, a detail in a leaked diplomatic cable, two careful conversations with a former Belgian military officer.
He was not entirely certain what the building was.
He was certain enough.
He sat for 40 minutes.
A man in his mid-40s sat down across the table from him without invitation.
Light jacket, >> >> no briefcase, unhurried.
He said his name was Daniel.
Karim put a folder on the table, 31 printed pages.
He said, “I think there is something here worth your time.
” Daniel ordered coffee.
He did not touch the folder.
He said, “Tell me what’s in it.
” Karim spoke for 30 minutes.
He described the ISIS European recruitment architecture and his own profile, Belgian passport, Moroccan heritage, logistics background, Arabic and French fluency, and the ways it matched exactly what ISIS was building toward.
He was not proposing to be an informant.
He was proposing to be a target.
To let ISIS find him.
To let them build their case from the outside believing every piece of it.
Daniel listened without interrupting.
At the end, he asked four questions.
Then he glanced at Kareem’s wrist.
The watch sat loose over the cuff, thin silver case, cracked clasp.
Kareem said nothing.
Daniel did not ask.
He told Kareem to return to Antwerp and wait.
14 days later, a woman arrived at Kareem’s apartment.
She gave a different name.
She stayed for 3 hours and took no notes.
She was the one he would call after every meeting for the next 2 years.
What Mossad needed to build was a channel, a way for ISIS to come across information about Kareem without being directed toward it.
That problem was solved by an asset already operating in Brussels, embedded in freight brokerage networks that overlapped with ISIS’s European facilitators.
>> >> His task was specific.
Let information about Kareem surface, not pushed, available.
An employment gap, an apartment address, a seven-word comment left under a Belgian news article about the Liège bombing naming ISIS directly.
>> >> The channel began operating in January 2015.
March 2015, Brussels.
The first approach came through a community contact, indirect, deniable.
A mutual acquaintance passing along an invitation to a conversation.
ISIS standard methodology.
Never a direct approach, always a sequence of touch points designed to make the target feel he was arriving at his own conclusions.
Kareem responded exactly as scripted, cautious at first, then gradually more open.
>> >> Over three meetings in April and May, coffee shops across central Brussels, he moved through the stages ISIS expected.
Measured frustration, then alignment, then quiet commitment.
After each meeting, he drove to a parking structure in the Excel district and sat in his car.
Her call came 3 minutes in.
Names, questions asked, information provided, >> >> direction of travel, everything logged.
October 14th, 2015, Molenbeek, Brussels.
Three men, a rented apartment with the curtains drawn.
They told Karim what they needed.
Names of Mossad officers operating in Europe, meeting locations, safe houses.
They spoke for 40 minutes.
Then they gave him a contact method and a code name.
He shook hands with each of them.
He said he understood what was being asked of him.
He said he was ready.
He walked three blocks to his car.
He sat behind the wheel for 90 seconds.
Then he took out a secondary phone and dialed.
His handler picked up on the second ring.
Karim said, “I have names, a meeting location, a contact protocol, and a code name.
How long do you need?” The handler said, “Start talking.
” Karim had not slept the previous night.
He started talking anyway.
In the 6 weeks after the Molenbeek meeting, Karim delivered three packages.
The first was a list of seven names, Mossad officers supposedly active in Western Europe, their cover professions, their cities.
The list had been prepared in Tel Aviv.
Three of the names were real officers who had already been redeployed.
Two were composite identities with no operational value.
Two were fabricated entirely.
All seven were handed to Dawood as verified intelligence.
Dawood filed them.
His superiors were satisfied.
The second package came 6 weeks later.
A building address in Amsterdam used, according to Karim, for Mossad liaison meetings with Dutch intelligence.
The address was real.
The building had housed a Mossad-linked operation 2 years earlier and had since been vacated.
Mossad had kept the lease.
Dawood sent a team to observe the building for 9 days.
They reported normal commercial foot traffic.
He logged this as confirmation that Mossad’s operations were well concealed.
The third package arrived in January 2016.
Communication protocols, contact frequencies, internal terminology, Kareem claimed, came from his Mossad briefings.
All of it had been constructed by a team in Tel Aviv over 3 days.
Davoud cross-referenced everything against his existing intelligence picture.
It matched.
He wrote in his operational log that the source was reliable, consistent, and showing signs of deepening commitment.
Antwerp, January 2016.
Davoud Al-Zaidi had been running European operations for 4 years.
He worked from three locations, rotating on a schedule he changed personally every 3 weeks.
He kept no digital record of source contacts, only a physical log, written in a shorthand no one else in the network could read.
He’d recruited nine assets in 4 years.
Six had been productive.
Two had been burned.
The ninth, Kareem, was different from all of them.
The others had come through networks.
Kareem had come through a process, identified, assessed, developed over months, confirmed through multiple channels before first contact.
The Brussels source had been reliable for 11 months before Davoud made the direct approach.
Every step had been structured correctly before the first meeting.
The apartment he used in January was a one-bedroom rental in the Zurenborgh quarter, a residential block with a courtyard visible from the desk.
He worked there in the mornings.
He had a system for Kareem’s reports, transcribed the relevant elements into the log within 2 hours of receipt, then destroyed the original.
He had been doing this for 3 months without interruption.
He read the latest report.
He added a line to his log.
He closed it.
He was satisfied.
Two weeks after the first recruitment confirmation, he’d been told by a senior coordinator that the network considered the operation to be among the most significant European intelligence efforts in 3 years.
Leadership did not typically offer assessments of this kind.
Davoud had filed the note and said nothing about it to anyone.
He thought about Karim between meetings, not with warmth, but with professional attention.
The man was composed.
He asked for nothing.
He arrived on time and did not negotiate.
In Davoud’s experience, assets who asked for nothing were either genuinely motivated or already working for someone else.
He had run the standard verifications three times.
Nothing had flagged.
What Davoud Al-Zaydi did not know, sitting at that desk in Antwerp, was that every piece of intelligence he had filed since October was sitting in a Mossad database, not as a threat to be counted, but as a map to be followed.
February 17th, 2016, Amsterdam, the Netherlands.
2:19 in the afternoon.
They met in a hotel bar near the Leidseplein, busy enough that two men in conversation drew no attention.
Davoud arrived first.
He ordered water.
He sat facing the entrance.
Karim came in 8 minutes later.
He sat down without greeting and ordered coffee.
Davoud said, “Let’s go through it.
” Karim opened his jacket and removed a folded sheet of paper.
He had memorized the content before leaving Antwerp.
The sheet contained nothing readable if intercepted.
The conversation was the delivery.
He named four people.
The first, a man running Mossad’s human intelligence coordination for the Benelux region, operating under cover as a trade attaché in The Hague.
Karim gave the office address, the schedule, the vehicle.
The second, a logistics officer in Frankfurt, >> >> responsible for moving materials between Mossad field teams across Germany and Austria.
The third and fourth were support personnel, low-level, but their identities gave texture to a network diagram.
Dawoud listened to each name without writing.
After the fourth, he was quiet.
Then he said, “How confident are you in the Frankfurt name?” Kareem said, “90%.
I need one more sighting to confirm.
” Dawoud nodded.
>> >> He said he would flag it accordingly.
He reached for his water glass.
As he did, his eyes moved to Kareem’s wrist.
The watch caught the afternoon light.
Thin silver case, old clasp, tarnish on the band.
Dawoud said, “That’s an unusual watch.
” Kareem said, “My father’s.
He gave it to me when I was 17.
” Dawoud held his gaze for a moment.
Then he said, “It suits you.
” He did not ask anything else.
Across the table, Kareem’s coffee sat untouched.
In his coat pocket, a secondary phone had been recording since he sat down.
Within 4 hours, the full transcript, four names, >> >> the Frankfurt caveat, Dawoud’s note-taking method, the sequence of his questions would be in Tel Aviv.
The four names Kareem had given Dawoud were constructed.
The intelligence Kareem extracted from Dawoud, through the texture of the meeting, the follow-up questions, the implied network references, the gaps that revealed what ISIS already knew, was real.
By April 2016, Mossad had identified 17 individuals connected to ISIS’s European facilitation network.
11 unknown before the operation began.
By June, >> >> three were under active surveillance in three countries.
Five more packages reached Dawoud over the spring and summer.
One of those meetings took place in Frankfurt in July, a cafe near the Hauptbahnhof.
45 minutes with Dawood’s courier, and what Karim extracted from that conversation confirmed the logistics officer he had named in Amsterdam.
An address, a schedule, a contact pattern.
Two of the five packages triggered internal ISIS verification against their existing network maps.
Both came back confirmed.
What they did not know was that their verification channel had itself been identified by Mossad 4 months earlier.
By August, the map ran to 43 nodes across six countries.
11 had been unknown before the operation began.
Four had since been neutralized through partner agencies in ways ISIS could attribute to routine security failures.
The operation would run for more than 2 years from the day the Brussels channel first went live.
Then, in September, Dawood called a meeting outside the normal schedule.
He said, >> >> “The people above me are asking for something more than information.
” He said, “They want to know you are really ours.
” Karim said, >> >> “What does that mean?” Dawood said, “A demonstration.
Something that cannot be explained away or walked back.
” He did not specify.
He said he would be in touch.
Karim drove back to Antwerp.
He called his handler and gave the full account.
His handler listened.
Then there was a pause.
The handler said, “We expected this.
Don’t agree to anything until we speak again.
” The line went quiet.
What ISIS wanted was not another name on a list.
It was proof of a different kind.
The kind that closes every exit, that makes a man’s position irrevocable.
The kind that cannot be staged in a Tel Aviv office over 3 days.
What do you do when ISIS stops asking for intelligence and starts asking for something that cannot be faked? The call came on a Tuesday morning in October 2016.
Dawood spoke for 11 minutes.
He did not begin with a greeting.
He said, “We have identified a Belgian security official who has been running sources inside our network for 18 months.
He uses a residential cover in Schaerbeek.
We have tracked his pattern for 6 weeks.
” He said, “We need him removed from the picture, and we need you to be part of the team that does it.
” He said, “This is your demonstration.
” >> [clears throat] >> Kareem sat with the phone against his ear for a moment after Dawood stopped speaking.
He said, “When?” Dawood said, “3 weeks.
I will give you the detail.
” The line went quiet.
Kareem took out the secondary phone and called his handler.
The handler listened to the full account, then said, “Stay on the line.
” The silence lasted 4 minutes.
Then a different voice came on, older, deliberate, and said, “We heard.
Don’t commit to anything specific yet.
Tell Dawood you need the operational detail before you can confirm.
We’ll be back to you in 48 hours.
” Kareem said, “And if you can’t build something in 48 hours?” The voice said, “We’ll build something.
” 48 hours meant 2 days in a building on the Rue du Congrès in Brussels, in a room with no natural light, and a table covered in aerial photographs of the Anderlecht industrial zone.
Four people, >> >> a case officer Kareem had never met, who ran the session standing up, a logistics specialist who spent most of the 2 days on a separate phone, a technical officer who brought a duffel bag of equipment and said almost nothing.
The scenario had to meet three conditions.
First, Kareem had to be physically present and visibly active.
ISIS would want a witness account detailed enough to contain information that only a participant could know.
Second, no one could be harmed.
The target would be a Mossad operative.
The exchange would generate real forensic evidence, shell casings, displacement marks, scorching on concrete, but controlled enough that everyone walked out.
Third, the aftermath had to be stageable.
A blood trace, a vehicle, photographs ISIS could verify against the location.
The technical officer laid both weapons on the table side by side before he said a word.
He briefed Kareem for 20 minutes.
Factory rounds, no unusual ballistic signature, timing triggers for the controlled window break.
He walked Kareem through the exact position, 12 m from the Citroen’s rear corner, a 40° firing angle that would place rounds in a pre-prepared concrete panel rather than through the vehicle.
Kareem asked where the panel was embedded.
The officer pointed to a photograph.
Then he picked up both weapons and put them back in the bag.
The location was chosen after 4 hours of elimination, an industrial block off the Rue de Birmingham in Anderlecht.
Freight loading bays, no residential windows, a dead end access road that allowed controlled approach and exit.
Thursday night after midnight, a textile processing facility nearby ran night shifts >> >> and generated enough ambient noise that a short firefight would not register against it.
The operation was timed to run 47 minutes from first movement to last.
18 of those minutes were allocated to the staged aftermath.
Kareem went through the plan three times.
>> >> He had two questions.
The case officer answered them without ceremony.
On Thursday, November 3rd at 11:45 in the evening, Kareem drove into Anderlecht.
The access road was exactly as the photographs had shown it.
A single sodium light at the far end of the loading bay >> >> cast an orange oval on wet concrete.
The Mossad team was already in position.
He could see none of them, which meant the positioning was correct.
He parked and cut the engine 2 minutes before the sequence began.
At 11:51, a dark gray Citroen moved into the far end of the loading bay, headlights off, as planned.
At 11:52, Kareem moved from the car.
What followed in the next 4 minutes was controlled, in the sense that every element had been pre-assigned and rehearsed.
The exchange was short and loud.
Shell casings hit the concrete.
The Citroen’s rear window shattered, a controlled break prepared in advance.
The operative went down behind the vehicle on cue.
Kareem was 12 m away.
He could see the concrete.
He could not see the man’s face.
Then, from the north end of the access road, headlights.
A federal police patrol vehicle turned into the street.
It had not been in the surveillance pattern.
The textile facility shift change had pushed a police rotation in the area by 22 minutes, a variable no one had tracked because it had not varied in the six prior weeks.
The Mossad team had 4 seconds between the headlights appearing and the point at which the patrol would have visual on the loading bay.
The case officer’s voice came through the earpiece.
Abort.
Pull back now.
Kareem was back in his car in 90 seconds.
The team dissolved into the surrounding streets.
The Citroen left through an alternate exit.
The operative was upright and moving.
The shell casings were on the concrete.
The staged blood trace had not been laid.
The photographs had not been taken.
The patrol moved slowly down the access road.
Its lights swept the loading bay.
A door opened.
An officer stepped out.
Kareem drove north on the ring road.
He turned off the secondary phone.
His handler had been explicit.
“If something goes wrong, radio silence until contact comes to you.
” He drove to a hotel near the Gare du Midi and paid cash for a room.
The watch said 12:41.
Dawud called at 9:00 the following morning.
He said, “Report.
” Kareem had been building the account since 3:00 a.
m.
He spoke for 8 minutes without interruption.
He described the location, the timing, the exchange.
He said the target had gone down.
He said the team had withdrawn when the patrol entered the area.
He said he could not confirm the outcome.
He had not been close enough to the target at that point, and they’d pulled out before the situation resolved.
Dawud said nothing for 12 seconds.
Then he said, “Can you confirm the shell casings?” Kareem said, “Yes, I can give you the exact position in the bay.
” Dawud said, “I’ll be in touch.
” He called back 11 hours later.
He said, “Belgian police logged an incident.
Unoccupied industrial area.
Shell casings consistent with your account.
No body.
No vehicle.
” He said, “No hospital admissions in the district.
” He said, “This could mean several things.
” Kareem said, “He had backup.
They moved him before the scene could be processed.
>> >> These people do not leave situations open.
” 9 seconds of silence.
Dawud said, “We will try to verify independently.
Do not use normal channels until I clear you.
” The channel went dark.
For 72 hours, Kareem had no contact with his handler >> >> and no confirmation of his status with Dawood.
He stayed in the hotel.
He did not go outside.
On the second day, Dawood sent a single message through the encrypted channel.
Stand by.
Nothing else.
Karim read it 12 times.
The account held on two things, the shell casings, which were real, >> >> and the location detail, which was accurate to within a meter.
It broke on the absence of a body, a vehicle, a photograph.
He had built the version around a single gap.
The target had been extracted before leaving any recoverable trace, >> >> but Dawood was not a man who settled for gaps.
On the morning of the fourth day, >> >> the secondary phone vibrated.
His handler said, “Dawood accepted the account provisionally.
He’s logging the outcome as unconfirmed, but the operation as executed.
You have a window, but they’ll be watching closer from now on.
” Had Dawood accepted the account because the evidence held, or because losing a source as valuable as Karim was a cost he was not yet willing to pay without stronger grounds to doubt him? And how long before those grounds arrived on their own? The acceptance had been provisional.
For Dawood, provisional meant a second line of inquiry running in parallel.
He contacted a source in the Belgian Moroccan community network, not the Brussels asset, a separate node, and gave a name.
Karim Haddad, logistics background, Antwerp.
They asked for a background verification, employment history, address, movement patterns, social connections.
He asked specifically about the period following the Liège bombing in January 2014.
The results came back over 5 days.
Employment gap after his brother’s death, documented, consistent with a period of acute grief.
Apartment in Antwerp confirmed.
Occupied since 2012.
Utilities paid on time.
Mosque attendance sporadic, as Kareem had described it himself.
The comment under the Belgian news article naming ISIS verified at source.
The social isolation following the bombing corroborated by two separate contacts who had known Yousef personally.
Dawoud read the report twice.
Then he read it a third time.
On the third pass, he stopped at one entry.
September 2014.
Kareem Haddad had taken a 7-day trip abroad.
The destination listed in the Belgian exit record was Israel.
Specifically, Tel Aviv.
The stated purpose was tourism.
A man who had lost his brother to an ISIS device 8 months earlier had traveled to Israel alone for a week and recorded the reason as tourism.
Dawoud did not flag this as confirmation of anything.
He could construct six plausible explanations without much effort.
Grief tourism, a contact from the logistics industry, a woman, a need to be somewhere unrecognizable.
He noted it as an anomaly and filed the report under the source’s operational dossier.
He added a single line to his log.
Verify.
Then he closed the folder and thought about other things.
December 2016.
The information reached Mossad’s European desk on a Thursday afternoon through an intercept from a French counterterrorism operation in Lyon.
A cell unconnected to Dawoud’s network had been compromised in a French police action 2 days earlier.
In the seized materials, a hard drive, a set of partially decrypted communications, there was a cross-reference document.
An internal ISIS network registry listing active European assets by region.
Under the Benelux heading, one entry, a Belgian-Moroccan logistics coordinator, Antwerp, status active, source of recruitment listed as European Facilitation Network.
The entry did not contain Kareem’s name.
It contained enough adjacent detail that a Mossad analyst flagged it within 4 hours of the intercept arriving.
By 6:00 in the evening, Kareem’s handler had issued the instruction by landline.
Full communication blackout effective immediately.
No secondary phone.
>> >> No contact through any established channel.
Wait for contact to come to you.
The handler said, “This is not confirmed to be you, but we cannot take the risk while the French materials are still being processed.
ISIS’s internal security division will be running the same cross-reference we just ran.
>> >> If they reach the same point, they will move faster than we can warn you.
” He said, “11 days, then we reassess.
” Kareem said, “And if Dawud calls during those 11 days?” The handler said, “You don’t pick up.
” Antwerp, the ninth night, 3:14 in the morning.
The apartment was dark except for the amber strip of street light coming through the gap in the curtain.
Kareem lay on his back and looked at the ceiling without moving.
The watch was on the bedside table.
He had taken it off before lying down, something he did not normally do.
He was not certain when the habit had formed.
Somewhere in the first few nights of the blackout, it had become part of the pattern.
Take off the watch, set it face up on the table, >> >> get into bed, look at the ceiling.
He had not been sleeping more than two or three hours a night.
He was not particularly frightened.
He was doing the calculation.
Dawud had called on day four.
Kareem had not picked up.
Davoud had not called again.
That was the detail he kept returning to.
Not the call, the silence after it.
A man running a source who goes dark for 4 days with no prior notification does not simply wait.
He opens a file.
He looks at the last thing that felt wrong and asks himself whether it was the start of something larger.
The last thing that had felt wrong from Davoud’s perspective was Anderlecht.
Karim ran the scenarios the way he had learned to, not anxiously.
Anxiety had been the first thing he had needed to remove from the process because it generated conclusions the evidence did not support.
But the way he had once run freight schedules, what is confirmed, what is inferred, what is unknown.
Confirmed.
Davoud had accepted the Anderlecht account on a provisional basis.
Confirmed.
Davoud had opened a secondary verification on him in the weeks that followed.
Inferred.
The verification had returned results consistent enough that Davoud had not acted on whatever he found.
Unknown.
Whether Davoud had found the Tel Aviv entry in the Belgian exit record.
Unknown.
What a man like Davoud did with four unanswered days and an open question.
He looked at the watch on the table.
3:17 now.
The cracked clasp caught the light from the street.
If Davoud had found the Tel Aviv entry >> >> and made the correct inference, 11 days of silence would not have produced a single missed call.
It would have produced a different kind of visit entirely.
No visit was, in the arithmetic of his situation, a data point.
He closed his eyes.
He did not sleep.
On the 11th day, the landline in the apartment rang at 10:00 in the morning.
His handler said, “The French materials have been fully processed.
Your registry entry was not cross-referenced to Dawood’s operational network.
The Benelux listing was in a separate compartment that his division does not appear to have accessed.
ISIS internal security closed their review yesterday.
As far as we can determine, the connection was not made on their end.
” She said, “You can resume contact, but we are moving the operational timeline forward.
We are no longer looking at an open-ended run.
By the end of the year, at the latest.
” Kareem said, “Dawood will want to know where I’ve been.
” She said, “Tell him you had a personal matter that required you to go offline.
He can verify or not.
There is nothing to find either way.
” She said, “The more important question is what he did with 11 days and an unanswered call.
” Kareem said, “I’ve been thinking about that.
” She said, “So have we.
” Antwerp, the same week.
Dawood Al-Zaydi sat at his desk in the apartment in the Zurenborgh quarter and looked at the open page of his operational log.
The single line he had written six weeks earlier, “Verify.
” Below it, after the verification results, a note about the Tel Aviv trip marked with a question mark.
Below that, nothing.
He had not added anything since the verification closed.
He had not called Kareem again after the fourth day of silence.
A second unanswered call told the source that the gap had been noticed.
He had decided it was better for Kareem to believe the silence had gone unregistered, to let him return on his own terms and on his own timeline, and to watch how he behaved when he did.
That was the standard approach for a source behaving unusually.
Watch before you move.
He turned to a fresh page.
He wrote one line.
11 days.
Below it, he wrote, Tel Aviv, September 2014.
He sat for a moment looking at the two lines.
Then he capped his pen and set it down.
Outside the courtyard window, the morning was gray and still.
He had built this operation correctly.
He had checked it through two separate verification processes.
He had given it the most rigorous intake procedure of any source he had ever run.
And he was sitting alone at 6:00 in the morning in Antwerp with two lines he could not explain and a source who had been unreachable for 11 days and no grounds to act on any of it.
He left the two lines on the page.
He went to make coffee.
He did not close the notebook.
Early 2017, Antwerp.
The internal investigation had been running for 6 weeks before Kareem’s name appeared on the list.
ISIS counterintelligence, a separate division from Dawood’s network, reporting through a different chain, had been reviewing European asset performance following a pattern of operational failures accumulating since spring.
Seven nodes compromised in 5 months.
Three arrests in Germany.
Two safe houses in France that had gone cold without explanation.
The losses were not catastrophic in isolation.
In aggregate, they indicated a source.
The counterintelligence team had been working from three starting points.
The Leon cross-reference, the German arrests, and an internal audit of intelligence outputs from European assets over the previous 18 months.
The audit had produced a consistent pattern.
A divergence between what European assets claimed to be gathering and what was verifiable on the ground.
Officers named in source reports had not been seen in the locations described.
Structures reported as active showed no movement when checked.
The audit had taken 11 weeks.
At the end of it, there were four names.
Karim’s was third on the list.
The team arrived at the Liège safe house on a Tuesday night in April 2017.
Karim had been in Liège for 36 hours using the address for a scheduled transmission.
He had not known the city was a risk.
He had not known he was on the list.
What he knew, because his handler had told him 4 days earlier, was that the network had flagged unusual activity in two Belgian cells, and that he should be prepared to move on short notice.
He heard footsteps on the stairs at 11:40.
Multiple sets moving fast.
The stairwell gave him 9 seconds.
He went out the window.
The roof of the adjacent building was 2 m below and four across.
He cleared it.
He came down hard on his right knee and kept moving.
The roof was flat, gravel surfaced, dark.
Ahead, a parapet, a drop, another building.
Behind him, the window, voices, someone pulling themselves through.
He crossed three rooftops in 90 seconds.
The gravel cut into his hands at the second parapet.
He registered it and kept moving.
At the third building, the gap was wider.
He crossed it at a run and landed on a raised service duct that shifted under his weight.
He was past it before it gave way.
On the fourth roof, he stopped at the north parapet and took out the emergency phone, a separate device kept for exactly this, never used before.
He pressed the single pre-programmed key.
>> >> The line connected in 4 seconds.
A voice said, “Location.
” He gave the cross street.
>> >> He said, “North parapet, fourth building from the safe house, two or three behind me.
” The voice said, >> >> “Stay.
” 40 seconds later, a car turned into the street below.
The driver flashed the lights twice.
He went over the parapet and down a drainpipe.
He was in the car before the men on the roof above had reached the third building.
The car did not stop moving.
The driver said nothing.
He drove southwest for 22 minutes, then pulled into a car park beneath a commercial building and cut the engine.
A woman was waiting beside a second vehicle.
She handed Kareem a bag.
She said, “Everything you need is in there.
We leave in 3 minutes.
” He got into the second car.
The strike had been scheduled for 72 hours after extraction.
Mossad’s operation team had been staging it for 6 weeks.
The intelligence Kareem had accumulated over the course of the operation had mapped 43 nodes across six countries.
Not all 43 were actionable.
11 were surveillance targets.
Seven were under active assessment.
The remaining 25 were confirmed active elements of ISIS’s European recruitment and facilitation network with sufficient documentation for coordinated action by partner agencies.
22 were taken in the initial sweep.
Belgium, four arrests, including two facilitation coordinators who had been running the Brussels channel as a genuine ISIS asset after Mossad had quietly stepped back from it 6 months into the operation.
France, six arrests.
One of them was a man who had been on French intelligence’s radar for 2 years without a workable evidence basis.
The Frankfurt file Kareem had developed through the July meeting provided it.
Germany, four arrests and two safe house seizures, one of which had been in operation since 2013.
The Netherlands, three arrests.
The Amsterdam hotel where Kareem and Dawood had met in February 2016 was searched.
In a maintenance room on the second floor, behind a panel that had not been disturbed, investigators found a sealed envelope.
Inside, a contact list, a communication schedule, and a map with seven locations marked across three countries.
Dawood had left it there 4 months before Kareem’s first meeting at that location.
Spain and Turkey, three more.
Of the 22 taken, 16 were held on terrorism charges through the following year.
Three were released on insufficient evidence and placed under surveillance.
Three remained in custody through 2018.
The total number of individuals whose identities Kareem had provided to Mossad, directly or indirectly, over the course of the operation, 61.
The number Mossad had confirmed as active ISIS assets before passing to partner agencies, 38.
The sweep ran for 71 hours.
Antwerp.
The third morning of the sweep.
Dawood Al-Zaydi saw the first report on a news aggregator at 6:42 in the morning.
A Belgian Federal Police statement.
Four individuals detained in connection with an ongoing European counterterrorism investigation.
No names.
No network affiliation named.
He read it twice.
He opened his operational log to the last page he had written.
The two lines.
11 days.
Tel Aviv, September 2014.
He sat for a long time without moving.
Then he went back to the desk.
He tore the last page from the notebook.
He folded it twice and put it in the document wallet.
He closed the log, placed it inside the wallet, and put the wallet in his coat.
He stood.
He looked at the courtyard window.
The morning was the same gray it had been for weeks.
He made two calls in the following 40 minutes.
The first was to a contact number that had been active for 3 years.
It rang without connecting.
The second was to a fallback number he had not used since establishing it.
That line connected.
The voice on the other end said one word and ended the call.
He left the apartment with a document wallet, a change of clothes, and nothing else.
He did not look back at the desk.
Karim Haddad ceased to exist as a legal identity in the Belgian national registry on the 23rd of May, 2017.
The person who had his face spent the following weeks in a succession of transit locations, a hotel in a city recorded on no document, >> >> then another, then an apartment arranged through intermediaries he never met directly.
By July, the paperwork had settled into a new shape, a name he had been given rather than chosen, a passport with a photograph that looked exactly like him, a history that was shorter than the real one, and contained no brother, no Liège, no Antwerp.
What he carried was not on any document.
In the bag the woman had handed him in the car park, beneath a change of clothes and an envelope with currency in four denominations, there was nothing of his own.
Everything inside was new.
Everything except what was already on his wrist, what had been on his wrist since the morning he stood in a mortuary in Liège and asked to see his brother’s personal effects.
He sat on the edge of the bed in the transit room and looked at it, the thin silver Seiko, the cracked clasp, still running.
He took it off.
He set it on the table beside the bag.
He sat with it for a moment, then he put it back on.
He did not take it off after that.
Disclaimer : This content may be created by AI for entertainment purposes. Any resemblance to real persons, events, or places is coincidental.
