ANALYSIS: More Questions than Answers – What We Know About Moscow’s Concert Hall Attack

The March 22 attack on Moscow’s Crocus Concert Hall was the worst terrorist atrocity carried out in Europe by the Islamic State, leaving 139 dead and 182 injured at the time of writing.

An event of such magnitude and violence has raised questions as to how it could happen in the first place, in a country like Russia which has a reputation as a “police state,” exercising a great deal of control over citizens’ lives.

Who ordered the Moscow Concert Hall attack?

A group known as the Islamic State – Khorasan Province (ISIS-K) claimed responsibility for the attack.

It is not clear, based on the testimonies of the attackers after their arrests, where their allegiance lay, who they communicated with, who were their handlers, and who coordinated the attacks.

We do know that the ISIS-affiliated news agency Amaq published what appeared to be genuine bodycam footage of the attack as it took place, which seems to strengthen its claims of involvement.

Despite this, the Kremlin continues to suggest Ukraine’s involvement, with the head of Russia’s Federal Security Service (FSB), Alexander Bortnikov, going as far as to say, without evidence, that the US, UK and Ukraine were behind the attack, with Kyiv providing an escape window for the suspects, which Kyiv, Washington and London have categorically denied.

Who are the attackers?

Analysis of footage of the attack, published on social media, shows four gunmen in total, who have been identified as Dalerjon Mirzoev, Saidakrami Rachabalizoda, Shamsiddin Fariduni and Muhammadsobir Fayzov. The clothing worn by at least two of those arrested closely matches that depicted in the Amaq video. The quartet are said to be originally from Tajikstan.

Other Topics of Interest

Moscow Imposes Russian Car Insurance in Occupied Ukraine by 2025

Getting Russian car insurance requires a Russian passport and is seen by resistance groups as a move to coerce locals into obtaining Russian citizenship.

On the evening of March 25, three more suspects were arrested, Isroil Islomov and his two sons, Dilovar and Aminchon, residents of Tver, some 180 km (112 miles) northwest of Moscow.

Dilovar was the owner of the white Renault car that the suspected gunmen used to escape the crime scene. On being arrested he maintained his innocence saying he had sold the car to his brother-in-law a week before the incident.

The head of Russia’s Federal Investigative Committee, Alexander Bastrykin, told Russian leader Vladimir Putin during a teleconference on Monday that the Islomovs provided the attackers with the car, an apartment, and helped to transfer their money, according to a report in the Russian news outlet Meduza.

Kyiv Post has been unable to independently verify Bastrykin’s claims.

Where did the attackers get the weapons?

It is currently unclear how the attackers obtained their weapons. The available photos and videos indicate that they are modern assault rifle models and not older Soviet surplus weapons obtained from the black market. They appear to be AK-12 assault rifles or its civilian version, the TR3 carbine.

Source: Investigative Committee of Russia

Videos of the attack have shown the rifles being fired automatically, which would suggest the rifle to be the military-issued AK-12 variant. However, it would be relatively straightforward to modify a TR3 variant to fire on fully automatic. Confirmation of the version of weapon might make it easier to identify the source of the weapons.

The Russian news outlet Vedomosti quotes weapon historian Maxim Popenker who said the weapon depicted is most likely a first-generation, military Kalashnikov AK-12 assault rifle produced in 2018–2020. This has led to speculation in some parts of the Russian media that it could have been acquired from the Russian or other CIS military who are likely armed with the weapon.

Where were the police at the time of the incident?

The first law enforcement officers are said to have arrived after the attack ended and the suspects had escaped in the white Renault car.

Available footage indicates that the attack lasted around 10-20 minutes, which might explain the delay in the police response, but there is a police post adjacent to the Crocus concert hall which, if it was manned, raises yet more questions.

While Kyiv Post was not able to determine the average response time of Russian police, data from the US Federal Bureau of Investigation (FBI) has shown that US police generally respond within 1-6 minutes to active shooter incidents.

There is also much speculation about what seems to be the presence of several “men in blue” at the venue. While they could simply be security or administrative staff, the Belarusian pro-opposition news outlet NEXTA claims they were FSB officers. The men seem to be relatively calm and were seen to lock some of the doors to the concert hall. This action, some commentators claim, prevented some concertgoers from escaping and led to more casualties. This, in turn, has fueled conspiracy theories that the Kremlin was somehow involved in the attack to further inflame public support for the war in Ukraine and possible future mobilization.

Local journalists have said that they were pushed back to 500 meters (547 yards) away from the concert hall, which prevented them from seeing what was going on and hindered their coverage.

Were the security units informed of the possibility of an attack?

The US and other Western nations had warned Moscow of an impending terrorist attack within 48 hours on March 7, but pro-Kremlin voices shrugged it off at the time.

Russian President Vladimir Putin after his election victory also publicly dismissed the warning on March 19, just three days before the attack, and called it a “provocative statement.”

“All this resembles outright blackmail and an intention to intimidate and destabilize our society,” said Putin during a meeting with the FSB, as reported by Russian state media TASS.

Other theories point out the similarities between the Moscow attack and the 1999 Russian apartment bombings, which many believe to have been a false flag operation staged on Putin’s orders to justify the restarting of the military campaign in Chechnya and which, greatly bolstered the support for Putin, then a prime minister of Russia, in advance of his bid for the presidency.

The failure of Russian authorities to act more proactively after having been warned of a probable terrorist attack raises the question – was its inertia mere incompetence or a meticulously planned act of manipulation?

Where were the suspects caught?

The Russian authorities say the suspects were arrested in the Bryansk region bordering Ukraine.

Russian lawmaker Alexander Khinshtein, said the white Renault car used by the suspects had not complied with an order to stop, after which shooting ensued with one suspect arrested on the spot and others fleeing into the forest before being rounded up.

Meduza geolocated the location where Rachabalizoda had been detained as in the Navlinsky district of the Bryansk region, on the M-3 “Ukraine” highway, 140 kilometers (around 90 miles) from the Ukrainian border.

It has been suggested that the official arrest location was changed to better accommodate the Kremlin’s narrative of events of Ukrainian involvement.

Earlier reports were that the suspects were found in the village of Teply, 16 kilometers (10 miles) from Belarus, a destination that seems more likely were one reluctant to travel through an area where fighting was ongoing. Moscow’s version was supported by the Belarusian state news channel BELTA which said Belarusian special services had been involved in the arrests, citing comments from the Ambassador of Belarus to Russia, Dmitry Krutoy.

What followed the arrests was a series of gruesome beatings and torture, where one suspect had his ear cut off at the scene of arrest before detention.

How did they get so far?

The suspects managed to cover some 300 kilometers (almost 200 miles) before they were stopped and arrested – another source of questions.

According to the Russian news outlet Agency News, the white Renault car in question was stopped for speeding at 141 kph (90 mph) somewhere outside Moscow, where the speed limit was 90 kph (55 mph).

Normally, one would expect authorities to set up perimeter cordons around Moscow in response to a terrorist attack, which raises further issues as to how the suspects managed to leave the region and travel so far.

Again, this could be put down to incompetence or, as some would contend, more evidence that they were allowed to escape westward to provide further ammunition for alleged Ukrainian involvement.

Whatever the truth, incompetence, bad luck, or conspiracy, there remain many questions that Russian authorities may or may not attempt to answer.