KELLY MCEVERS, HOST:

When the terrorist group known as ISIS first declared its existence in 2014, the accepted wisdom at the time was that it wasn't interested in attacking enemies far away. Instead it was focused on targets in Iraq and Syria, and it wanted to govern there. New York Times reporter Rukmini Callimachi says that assessment is dead wrong.

Callimachi has written an extensive story about ISIS's external operations branch which is responsible for attacks in Paris and Belgium, and she joins us now. Welcome to the show.

RUKMINI CALLIMACHI: Thanks for having me, Kelly.

MCEVERS: First tell us about this external operations branch and when they first started send operatives to Europe to carry out attacks.

CALLIMACHI: So starting two years before Brussels in March of 2014, we start seeing operatives returning to Europe who have direct communication with the people who go on to do these devastating attacks. Starting in June of 2014, which is the same month when ISIS declares its caliphate, we have ISIS fighters who are arrested in Lebanon and France and who, under interrogation, say that they were ordered to attack the specific targets outside of Iraq and Syria by none other than Adnani, who is a very senior member of ISIS and the spokesman of the group.

So what I've been able to understand from reading these hundreds of pages, including interrogation transcripts of various people who were arrested, is that all along, as they were building the caliphate inside Iraq and Syria, they were also aiming to attack the West and specifically Europe.

MCEVERS: You report on one operative who was sent from Syria by ISIS to Europe. And one thing that's really interesting about his journey is the way he was instructed to wipe his devices and to use encryption software. Tell us a little bit about that software.

CALLIMACHI: So the operative was given a daylong tutorial in an Internet cafe in Syria on how to use an encryption software called TrueCrypt. And what experts have told me about it is that it has not yet been cracked by intelligence agencies in the West.

So he was instructed to write messaged and put them inside of a folder. The folder was then encrypted, and then that folder had to be uploaded to a Turkish website. It's a system that recalls what al-Qaida used to do with saving drafts in Yahoo folders, the difference being this is a Turkish website. It's not like Yahoo that the Justice Department could potentially browbeat into allowing a back door.

MCEVERS: And one of the things you write is that the reason that they are so careful is that they're learning from past mistakes.

CALLIMACHI: You know, I was able to count 21 distinct operatives - these are all European citizens; almost all of them are French or Belgians - who went to Syria and who were then sent back to carry out attacks in Europe. The vast majority failed. Some of them failed royally. There was one guy who tried to attack a bunch of churches in France, and all he managed to do was to shoot himself in the leg (laughter).

But from every one of those failures, what I think European intelligence agencies fail to see is that the group was learning. With every failure, it was tweaking its apparatus. It was trying new security protocols. It learned early on that cell phones and anything online is their biggest potential pitfall. They became disciplined, and then they started adding these other tools like encryption.

MCEVERS: You talk about how authorities didn't realize how ISIS was learning as a group. It seems early on that authorities didn't even realize that it was a group.

CALLIMACHI: Yes. I think what happened is they were looking at these small attacks, and up until November 13 in Pairs, all of these attacks were really on a small scale. If anything, the death toll was in the single digits. And so with each case, officials rushed to say, oh, it's a random act; oh, this particular operative doesn't appear to have ties to anybody else.

In fact, the ties to the organization are never apparent immediately. And as, for instance, France's domestic intelligence agency realized, wait a second; Mehdi Nemmouche, who carried out an attack on a Museum in Brussels in May of 2014 and was described as acting alone - oh, my God, he was actually in touch with Abaaoud, who was the leader of the Paris attacks.

As that intelligence started to come together, it was still very much in a silo. So the French knew it. The Belgians might know something. The Germans might know something else. The U.S. knew something else. And it appears to me that the larger image of this group that very much was interested in international terrorism did not really come to light until the tragedy of November 13 in Paris last year.

MCEVERS: That's Rukmini Callimachi, reporter with The New York Times. Thank you very much.

CALLIMACHI: It's my pleasure to be here. Thank you. Transcript provided by NPR, Copyright NPR.