A day before the U.S. embassy in Moscow put out a rare public alert this month about a possible extremist attack at a Russian concert venue, the local C.I.A. station delivered a private warning to Russian officials that included at least one additional detail: The plot in question involved an offshoot of the Islamic State known as ISIS-K.
American intelligence had been tracking the group closely and believed the threat credible. Within days, however, President Vladimir V. Putin was disparaging the warnings, calling them “outright blackmail” and attempts to “intimidate and destabilize our society.”
Three days after he spoke, gunmen stormed Crocus City Hall outside Moscow last Friday night and killed at least 143 people in the deadliest attack in Russia in nearly two decades. ISIS quickly claimed responsibility for the massacre with statements, a photo and a propaganda video.
What made the security lapse particularly startling was that Russia’s own security establishment had also acknowledged the domestic threat in the days before the massacre posed by the Islamic State affiliate in Afghanistan called Islamic State Khorasan Province, or ISIS-K.
Internal Russian intelligence reporting that most likely circulated at the highest levels of the government warned specifically of the increased likelihood of an attack in Russia by ethnic Tajiks radicalized by ISIS-K, according to information obtained by the Dossier Center, a London research organization, and reviewed by The New York Times.
Russia has identified the four men suspected of carrying out the attack as being from Tajikistan.
Now, Mr. Putin and his lieutenants are pointing fingers at Ukraine, trying to deflect attention from a question that would be front and center in any nation with an independent media and open debate in its politics: How did Russia’s vast intelligence and law enforcement apparatus, despite significant warnings, fail to head off one of the biggest terrorist attacks in the country in Mr. Putin’s nearly quarter century in power?
The full picture is still unclear, and U.S. and European officials, as well as security and counterterrorism experts, emphasize that even in the best of circumstances, with highly specific information and well-oiled security services, disrupting covert international terror plots is difficult.
But they say the failure most likely resulted from a combination of factors, paramount among them the deep levels of distrust, both within the Russian security establishment and in its relations with other global intelligence agencies.
They also point to the way Mr. Putin has hijacked his domestic security apparatus for an ever-widening political crackdown at home — as well as his focus on crusading against Ukraine and the West — as distractions that probably did not help.
This account of the Russian failure to prevent the concert attack is based on interviews with U.S. and European security officials, security experts and analysts specializing in international intelligence capabilities. Many spoke on the condition of anonymity to discuss sensitive intelligence details.
“The problem is to actually be able to prevent terrorist attacks, you need to have a really good and efficient system of intelligence sharing and intelligence gathering,” said Andrei Soldatov, an expert on Russian intelligence, who underscored that trust is needed inside the home agency and with agencies of other countries, as is good coordination. He said, “That’s where you have problems.”
An Expanding Definition of Extremist
Mr. Putin’s definition of what constitutes an extremist began to expand even before his invasion of Ukraine in early 2022.
The agency primarily responsible for combating terrorism in Russia is called the Second Service, a branch of the Federal Security Service, or the F.S.B. It once focused on Islamist extremists, bands of assassins and homegrown neo-Nazi groups.
But as Mr. Putin has advanced his political crackdown at home, its list of targets ballooned to include opposition figures like Aleksei A. Navalny, who died last month in a Russian prison, and his supporters, as well as L.G.B.T.Q. rights activists, Jehovah’s Witnesses, peace activists and other Kremlin critics.
The number of Islamist-related organizations on the register of extremist organizations listed by Russian Federal Service for Financial Monitoring has declined since 2013. At the same time, hundreds of organizations have been added related to Jehovah’s Witnesses, a recent target in Russia.
Security experts said the expanding focus wasted resources and diverted the attention of senior leaders.
The head of the Second Service, for instance, was increasingly involved in areas far afield from counterterrorism; in 2020, according to the U.S. government, he and his branch of the F.S.B. were involved in the poisoning of Mr. Navalny.
“Overall, the F.S.B. is a political police force, and as such it reflects Kremlin concerns,” said Mark Galeotti, a specialist on Russia’s security operations and a senior associate fellow at the Royal United Services Institute in London. “At present, the government is most exercised by political dissent and Ukrainian sabotage, so they are the F.S.B.’s priorities.”
They were pursuing “fictitious threats” rather than real ones, said one European security official.
Still, U.S. and European officials say the Russian officials tracking Islamist extremists have their own unit within the Second Service that has remained robustly staffed and funded, despite the strains on the security services from the intensifying domestic political crackdown and the war against Ukraine.
The failure to prevent the attack was probably the result of a combination of other factors, including fatigue after being “especially alert” during the period before Russia’s recent presidential election, said a European security official, who tracks the activities of the Russian intelligence services.
There is also evidence that Russian authorities did respond to the warnings this month, at least initially.
Increased Security
On March 7, the day after the C.I.A. station issued the private warning to the Russians, the F.S.B. announced that it had killed two Kazakhs southwest of Moscow, while disrupting an ISIS-K plot to target a synagogue in the capital. U.S. officials thought the raid was possibly a sign that the Russian authorities were springing into action.
Iosif Prigozhin, a well-known Russian music producer, recalled that he and his wife, the Russian pop star Valeriya, who performed at Crocus City Hall this month, noticed how security had increased at the venue in early March; security guards checked people’s bags and cosmetics cases and took other measures he hadn’t seen there before, he said.
“I even called the general director and said, ‘Listen, what’s going on? Are you expecting high-ranking guests?’” Mr. Prigozhin said in an interview. “He said, ‘Iosif, I’ll tell you later.’ He didn’t say anything over the phone. He said it’s necessary — and that’s it.”
Around the same time, the venue’s staff was warned about the possibility of a terrorist attack and instructed on what to do in such an event, said Islam Khalilov, a 15-year-old student who was working in the coat check on the night of the attack, in an interview posted on YouTube.
One of Mr. Putin’s favorite singers, Grigory Leps, was performing there on March 8. Shaman, a singer whose pro-Kremlin jingoism has catapulted him to popularity amid wartime fervor, was scheduled to take the stage a day later.
But the heightened security didn’t ferret out one of the attackers, Shamsidin Fariduni. Employees at the music hall, speaking to Russian media, recalled seeing Mr. Fariduni at the concert venue on March 7. A photo of him in a light brown coat at the venue, verified by The Times, has circulated in the Russian press.
Aleksandr V. Bortnikov, the director of the F.S.B., emphasized Tuesday in public comments that the information the United States provided was “of a general nature.”
“We reacted to this information, of course, and took appropriate measures,” he said, noting that the actions the F.S.B. took to follow up on the tip unfortunately didn’t confirm it.
In its March 7 public warning, the U.S. embassy said the risk of a concert venue attack in Moscow was acute for the next 48 hours.U.S. officials say it’s possible Russian authorities pushed hard around the 48-hour warning period but later grew more relaxed and distrustful when an attack didn’t occur.
It is unclear whether U.S. intelligence mistook the timing of the attack or the extremists delayed their plan upon seeing heightened security.
In the subsequent days, internal Russian intelligence reporting — which the Dossier Center said reached the Russian National Security Council — warned specifically about the threat that Tajiks radicalized by ISIS-K posed to Russia. The reporting pointed to the involvement of Tajiks in disrupted plots in Europe and attacks in Iran and Istanbul in recent months. The reporting didn’t mention the Western warnings or a possible Moscow attack.
But by then, the skepticism about the plot had grown within the Russian government, and Mr. Putin felt comfortable deriding the public warnings in a speech to top officers at the F.S.B., using the occasion to attack the West again.
“Because the F.S.B. — and Putin — sees the world through the prism that the United States is out to get Russia, any information that is not consistent with that frame is easily dismissed,” said Andrea Kendall-Taylor, a senior fellow at the Center for a New American Security, who previously led analyses of Russia by the U.S. intelligence community.
She said, “That dynamic may have resulted in an intelligence failure with devastating consequences.”
‘Duty to Warn’
When it informed Russia privately about the potential terror plot, the C.I.A. was adhering to 2015 guidance known as “duty to warn” directives, requiring the intelligence establishment to inform “U.S. and non-U.S. persons” of specific threats aimed at “intentional killing, serious bodily injury and kidnapping.”
These directives are relatively rare, but the United States is obliged to issue them, even to adversaries, and has done so with both the Taliban in Afghanistan and the Iranian government in the past year. The warnings aren’t usually made public unless U.S. authorities think the threat could impact American citizens, which was the case in Moscow.
Mr. Putin, in both 2017 and 2019, thanked the U.S. government for providing information that had helped Russia foil terrorist attacks in St. Petersburg. But analysts say a similar gesture would be impossible in the acrimonious environment he has created since invading Ukraine.
The United States has been tracking ISIS-K activities very closely in recent months, senior officials said. In the course of the monitoring, which has involved electronic intercepts, human informants and other means, American operatives picked up fairly specific information about plotting in Moscow, officials said.
Experts said Russia’s intelligence services have traditionally been focused on domestic terrorist threats emanating from separatist and religious extremist groups in Russia’s North Caucasus region. Large terrorist attacks on Russian soil attributed to international groups like the Islamic State or Al Qaeda have been rare, and the country’s domestic security services have less experience tracking those threats and are less skilled at penetrating Central Asian extremist cells.
The adversarial relationship between Washington and Moscow prevented U.S. officials from sharing any information about the plot this month beyond what was necessary, out of fear Russian authorities might learn their intelligence sources or methods.
In the days since the attack, Moscow has returned the favor to Washington for offering the tip by claiming its warning should be treated as evidence of possible American complicity.
Mr. Bortnikov, the F.S.B. director, said on Tuesday that Islamist extremists alone couldn’t possibly have carried out the attack. He blamed, among others, the United States.
Oleg Matsnev, Safak Timur and Aric Toler contributed reporting.