Paris attacks: How does a manhunt work?

French police are hunting Belgian-born Salah Abdeslam, a key suspect in the attacks on Paris which killed 129 people. But how do operations like this work and what are the difficulties faced?

At the scene

As with any crime, the key at the scene is to gather and decipher as much information as possible, as quickly as possible.

Witness statements need to be taken and processed, as do forensic findings.

After the Paris attacks, the rapid gathering of evidence allowed police to identify Brahim Abdeslam as the man who had blown himself up outside a bar.

A VW Polo with foreign licence plates was found near the Bataclan concert hall, where 89 people were killed. A parking ticket inside was tracked back to the Molenbeek suburb of Brussels. It's an area linked to previous attacks. The discovery led the police to realise that the car had been rented by Salah Abdeslam, the brother of Brahim Abdeslam.

"The two big things they would have looked for there were DNA and fingerprints," says Ian Turner, head for biological and forensic sciences at Derby University. The priority would be preservation of life, he adds, but even the boots of paramedics would be tested for forensic evidence.

The guns used would have been tested quickly for prints, as would the dismembered finger of one of the attackers. These would be cross-referred to databases held by the French authorities. The same applies to DNA, although the test results wouldn't be available for about 12 hours.

Witness statements and, if it exists, video footage taken by members of the public attending the concert or present at one of the other venues, would be very useful.

Turner says this, and CCTV footage, is part of what's known as "digital forensics", which, given the destruction at the Paris scenes, might have proved more useful in quickly ascertaining suspects than DNA and fingerprints.

Sometimes investigating officers benefit from a "stroke of luck". In 1993, after the World Trade Centre was bombed, a fragment of the van used was found at the scene that bore a serial number that identified it. One of the attackers, Mohammed Salameh, was arrested after reporting the van he had hired as stolen. In 1995, at the Oklahoma bombing, a fragment of a van with a serial number was again found.

"It's not surprising that the authorities don't know where the suspects are when they initially respond, as they're getting people into ambulances," says Roger Gomm, a former Metropolitan Police superintendent who lectures at the Cabinet Office Emergency Planning College. "It's quite chaotic for quite a long time. There would have been lots of people running from the scenes in Paris. That's a good time for someone to make a getaway."

Details from nearby

Cameras operating at the scene of a crime are immensely useful, as are those nearby, says Turner, helping to identify suspects and the directions in which they might have headed after the attacks. Sometimes, you can follow attackers right back to the point where they can be identified. The 7 July 2005 bombers in London were identified this way.

Facial recognition technology is available to police these days but images from CCTV can be too blurry for it work. This was a problem during the manhunt for the bombers who targeted the Boston marathon in 2013.

There is also automatic number plate recognition, which keeps a record of where vehicles have passed. France has its own version, which would have allowed police to trace where the car found outside Bataclan had been.

Containment

Once the police have an idea of who the suspect is, they need to catch them as quickly as possible. One way to enable this is to close down an area or even country, by imposing roadblocks, curfews and even border closures - or at least targeted checks.

This involves getting the best possible information about suspects to police and officials.

Salah Abdeslam was able to cross into Belgium from France on Saturday, being allowed to go after being stopped and checked. But it's unclear whether the French authorities had matched the VW Polo found at the Bataclan to him at that point.

Governments can quickly get extra checks put on airports, train stations and border points, says Gomm, adding: "But you've got to get there and to know what they're looking for."

Abdeslam was no longer in the car when it was picked up in the Molenbeek area of Brussels. Belgium, Germany, and any other country in the area will cooperate fully and quickly with the French authorities, says Gomm, but adds: "The further the suspect goes, the harder it is."

Also, some border points are better-run than others, depending on country, says Gomm. Some have fully functioning CCTV so that, even if orders are not issued in time, a dependable record of someone's movements is available afterwards.

Forming a profile

Once police have a name to work with, it might be possible to find their social media accounts. The information gleaned from here could lead to family members, friends and even accomplices.

If investigators are able to work out which phone a suspect is using then they might also able to follow it. "The great thing about mobile phones is that people tend to carry them wherever they go so if it's switched on they virtually become a free personal tracker," says Angus Marshall, a digital evidence practitioner.

Police will search for vehicles that are linked to the suspect, as well as those of their family and friends. Bank accounts will also be frozen and monitored.

There will have been a "process of connection" between those involved in the French attacks at some point, says Gomm. It's likely the operation moved into smaller groups, a "classic terror cell network", afterwards, he adds. "It's painstaking, but there are a lot of people who've been investigating this sort of situation for a while and doing it well."

Asking the public for help

This is another delicate procedure. Putting out pictures and descriptions of suspects is a good way of getting information, but it has downsides. "One of the problems that the police will have is that there will be just so much information coming in," says Andrew Silke, professor of criminology and director of terrorism studies at the University of East London. Mistaken sightings can deviate resources from the main manhunt.

CCTV image showing man suspected of placing a bomb in Bangkok, August 2015

They can also lead to false accusations. In August, a bomb killed 20 people and injured more than 120 in Thailand. Police released CCTV footage of the man they suspected of placing the bomb.

People on social media wrongly accused Australian actor Sunny Burns of the crime. He said people were sharing his home address online and that it led to police searching his house.

There's also a danger that misleading information can lead to panic.

But tip-offs from the public can make a big difference. David Copeland was convicted of a 13-day nail bombing campaign in London in 2000. He was caught after a colleague recognised the CCTV image released by police, explains Silke.

Raids/questioning

Once substantial information on suspects becomes available, there is questioning of family, friends and associates. This sometimes follows raids, as happened at 150 addresses in France on Monday. Reports say large numbers of weapons were found and several people arrested.

But another crucial source of information can also be found at this point. Computers can provide vital clues as to where suspects might be.

"The sort of things we'll be looking at are obviously email, web history and recent activity online to see if they've been looking at particular maps or building up information about certain places or even booking accommodation," says Marshall. "We'll also be looking at the people they regularly communicate with and the places they visit routinely."

French police special forces carry out searches in the town of Corcy after the Charlie Hebdo attacks in January

Wifi hotspots can be useful, he explains. Police can look at the networks that a laptop has connected to in the past and track the addresses. Mobile phones can also be a mine of information if they can be found. Investigators can look at who a suspect has been talking to and whether they have been making plans.

"If you take a photograph with your mobile phone, chances are it will embed GPS coordinates in the photo," says Marshall. All of this will help build up patterns of movement and assist investigators in working out where suspects might be hiding.

Catching suspects

Once the whereabouts of the suspect - exact or approximate - are ascertained, it's imperative to catch them quickly.

This can be a delicate operation. "The terrorist is unlikely to want to be taken alive," says Gomm, as to be captured involves the risk of giving away valuable evidence. This might mean approaching a safe house or other hideaway as stealthily as possible. If this goes wrong it could end up in another siege situation, with members of the public placed in extra danger.

Thermal imaging can be a great help to police at this stage. In 2013, it helped police in the US catch Boston Marathon bomber Dzhokhar Tsarnaev after he was spotted hiding in a boat in the backyard of a house.

Militants study what police have done to catch suspects in recent cases, says Gomm, meaning methods are constantly evolving on both sides.

One of the most crucial factors is whether the suspect meant to escape in the first place. "If it was planned that he would survive and try to get away there would have been plans put in place to help him achieve that in terms of money, transport and all the rest," explains Silke. "He'd have a far better chance."

But if that was never the intention then he would be forced to improvise. Resources will be limited and money will run out. Getting more cash might mean staging a robbery but that will draw attention. Suspects might be forced to ask friends and family members for help.

"Usually, they will fall back to what they know," says Silke.

Subscribe to the BBC News Magazine's email newsletter to get articles sent to your inbox.