BRUSSELS -- The bomb maker, the transporter, the landlord and the cipher. The four men slipped away after the Nov. 13 attacks in Paris, and all but one reappeared as key figures in the Islamic State cell that went on to attack Brussels.
Two are dead, one is captured, and the fate of the fourth remains a mystery.
Who lives and who dies in an attack can provide crucial clues to how terrorist cells are structured, demonstrating who is considered disposable and who is crucial for the next job. That status can be fleeting, as the two attacks show that someone considered vital in one operation may be sacrificed in another.
Some of the figures in the Paris plot had become "cannon fodder" by the time of the Brussels attacks, said Nicolas Henin, a journalist held hostage by Islamic State for 10 months.
"Once they had performed their services in Paris, they were considered expendable," he wrote. "That is how (the Islamic State group) works in terms of human resources."
THE BOMB MAKER
With a newly minted degree in mechanical engineering, Najim Laachraoui left for Syria in February 2013 -- a relatively early departure in the wave of Belgians who have travelled to fight with the extremists.
He returned home 2 1/2 years later as an expert in urban explosives, bearing a fake Belgian ID and an alias: Soufiane Kayal. On Sept. 9, 2015, police at the Austro-Hungarian border briefly stopped a Mercedes in which he was travelling and sent him on his way. In the car with him were Salah Abdeslam and another Islamic State recruit with a fake Belgian ID.
None of the three fired a shot in Paris the night of Nov. 13, but all played key roles in making it happen.
Laachraoui's job was to manufacture the TATP explosives and the suicide vests. His DNA was found on one of the vests that detonated inside the Bataclan concert hall as well as one that blew up outside France's national stadium. The man himself was nowhere to be found.
Thirteen days later, that same DNA was found in a safe house in Belgian town of Auvelais, and authorities soon linked the name Kayal to another apartment in nearby Charleroi, where some of the November attackers had stayed before travelling convoy-style to Paris. They didn't, however, connect the alias to Laachraoui.
The cell, meanwhile, appears to have found another place for the smelly, dangerous process of making TATP: a top-floor flat in the Brussels suburb of Schaerbeek. In hiding, at least one experienced bomb maker kept busy.
Criminals like TATP because it's relatively easy to acquire its ingredients, but the manufacturing process is volatile. In 1995, a plot to assassinate the pope and President Bill Clinton unraveled when a makeshift TATP lab in Manila caught fire, drawing the attention of authorities.
Without a real laboratory, the bomb maker would have needed tremendous care and steady nerves -- as well as massive amounts of ice to cool a noxious solution prone to catching fire, with windows wide open to avoid being overcome by the fumes.
It appears the cell was up to the task. In the Schaerbeek apartment, there was enough TATP for three massive suitcase bombs -- 15 to 20 kilograms each, experts say. There were also 15 kilograms left over and enough base materials to make 100 kilograms more, said Jimmie Oxley, a University of Rhode Island chemistry professor who specializes in explosives.
"A master bomb maker may be in play here," Oxley said.
But when it came time to carry out the plot, Laachraoui's career in building bombs came to an abrupt end. On Tuesday, he was one of three men who wheeled suitcases packed with explosives into the departures hall of Brussels Airport. Laachraoui and his companion wore black, down to the single glove on their left hands believed to have concealed their detonators. The third attacker wore white, a distinctive hat slightly askew as he pushed the one load that would not kill.
Why Laachraoui had gone from bomb maker to suicide bomber remains unclear. Had the group found a replacement? Had he become too much of a liability as police closed in on his trail? The answer remains a mystery.
"It's strange," said Patrick Skinner, a former CIA case officer who is now with the Soufan Group security firm. "They don't have a shortage of people that are willing to become a walking bomb, but there's always a shortage of talent. It's like having General Eisenhower lead the charge at D-Day. It's possible but it seems to be a supreme waste of talent."
THE TRANSPORTER
Salah Abdeslam drove thousands of miles across Europe over months, collecting accomplices, scouting locations and buying equipment. He rented apartments and cars and, on the night of Nov. 11, drove toward Paris with another onetime petty criminal and boyhood friend, Mohamed Abrini. The two were spotted together in a Renault Clio at a service station along the highway linking Paris and Brussels.
Abdeslam ditched the car in northern Paris and is believed to have discarded his unexploded suicide vest south of the city. And he called on two friends from Brussels' Molenbeek neighbourhood to drive through the night and pick him up. By then, Abdeslam's older brother Brahim was dead, the only victim of the suicide blast that demolished a bar in central Paris.
"He has a personality that is more complex than the terrorist automaton who is just there to blow himself up," Marc Trevedic, France's former anti-terrorist judge, told BFM television. "Not fragile, but complex."
But it may have been more than second guessing that kept Abdeslam alive that night and for the four months he spent hiding among friends back in Brussels.
"I think he had no desire to die, and he had other things to do," said Nathalie Goulet, a French senator and co-president of a commission that studied the jihadi networks now terrorizing Europe. "They escape, they gather back home, they resume, because that's their job."
Abdeslam was flushed out on March 15, when police went to search what they thought was a vacant apartment in the Forest neighbourhood of Brussels and instead were sprayed with gunfire. One man wielding a Kalashnikov held officers at bay as two others bolted across rooftops to safety. One of them was Salah Abdeslam. The second man remains unidentified.
One or both were important enough that the gunman kept firing until he was killed by a police sniper. Inside the apartment -- rented by the same man who exactly a week later would detonate his explosives in the Brussels metro -- was an Islamic State banner, shells and a book on Salafist Islam, the austere strain linked to the group.
But Abdeslam's days of freedom were numbered. By March 18, police had traced him to another hideout -- this time just around the corner from his childhood home in Molenbeek. He was shot in the leg as he tried to escape yet again. In the four days between his capture and the blasts that shook Brussels, he made no mention of a new plot afoot, nor did he explain his role in the Paris attacks, beyond what Belgian and French media described as blanket denials of responsibility or close ties to the attackers.
THE LANDLORD
Khalid El Bakraoui was another man with an alias and a warrant out for his arrest. He and his brother Ibrahim were known criminals, bank robbers and car thieves with a string of convictions between them.
Interpol issued an international warrant for his arrest in December -- soon after it was discovered he had rented the Charleroi apartment that served as a departure point for some of the Paris killers.
It took investigators until Dec. 9 to track down that safe house -- enough time that El Bakraoui was again entrusted with scouting locations for the network's growing number of accomplices and possibly for a new attack. Belgian media say the brothers had video of the home of a senior official at a nuclear waste facility in the Flanders region.
It was El Bakraoui who rented the Forest safe house and was seen leaving the Schaerbeek apartment that served as the explosives warehouse for Tuesday's attacks.
But he apparently ensured that his own home was scrubbed clean of links to Islamic State or the attacks. On Wednesday morning, investigators searched the homes of the El Bakraoui brothers and came up empty.
By then, the brothers were dead, Khalid in the Maelbeek metro station, his brother at the airport. When shown a photo of the brothers, Abdeslam claimed he did not know them.
THE CIPHER
Mohamed Abrini, a 31-year-old Belgian petty criminal and boyhood friend of the Abdeslams, is believed to have travelled early last summer to Syria, a short trip to the country where his younger brother died in 2014 in Islamic State's notorious francophone brigade.
But that wasn't his only international travel. He went multiple times to Birmingham, England, meeting with several men suspected of terrorist activity, according to a European security official who spoke on condition of anonymity because he was not authorized to provide details on the investigation. He said the meetings, including one later last summer, took place in several locations, including cafes and apartments.
Abrini's role in the subsequent weeks and months while the Paris attackers were coming together has never been clarified. He has been on the run since the Nov. 13 attacks but never resurfaced after the emergence of the surveillance video placing him in the convoy with the attackers headed to Paris. Like Abdeslam, he had ties to Abdelhamid Abbaoud, the charismatic ringleader of the Paris attacks who died in a police standoff on Nov. 18.
He is the last identified suspect still at large from the November attacks.
OTHER SUSPECTS
But there are suspects at large from the Brussels attacks. The man in the hat who accompanied the airport attackers and another man who led Khalid into the subway and drove a grey Audi that was spotted by surveillance cameras, according to a European security official, who was not permitted to speak publicly about spoke about the footage. Belgian media reported that the man missing from the airport was among those arrested Friday -- a new name in a web that seems to expand by the day.
"What is interesting here is the presence of watchmen -- the guy in white seen next to the two bombers at the airport and the driver of the bomber who attacked the subway line," said the official. He said he believed it was significant that no one with operational links and knowledge of the chain of command was thought to be alive.
But that interpretation may be the optimistic one, said Skinner, the former CIA case worker.
"They are more resilient than you would want and that you'd ever expect, and they have more people who know what they are doing," he said.
Claude Moniquet, a French former intelligence officer who works in Brussels, said there were two possibilities for the men on the run: One is that they are the shattered remnants of a cell that has lost its access to explosives and weapons, and lacks contact with any other Islamic State operatives in Europe. The other is more menacing.
"They could try to reach those other cells, and we will find them another day in another terrorist action somewhere in Europe," Moniquet said.
Soon after the bombs went off in Brussels, French authorities renewed their arrest bulletin for Abrini. Identifying features: Unknown. Clothing: Unknown. Vehicle: Unknown.
Hinnant reported from Paris. Associated Press writers Paisley Dodds in London and Lorne Cook, Raphael Satter and Raf Casert in Brussels also contributed to this report.
