(CNN) -- It was almost midnight when the surveillance team spotted their target at the base of the cavernous luxury apartment complex. He fit the picture on the international arrest warrant which had urgently been issued just weeks previously -- a French-Algerian in his early 20s with buzz-cut hair and thick arching eyebrows.
The agents, who belonged to the DCRI -- France's domestic security service, logged the time -- 23.20 on February 11, 2014 -- and immediately radioed their superiors, who told them to move in to make the arrest.
When he saw them, the man fled through a gate leading to the staircases, according to French investigators. They gave chase as he clambered up the stairwell to the floors with commanding views over the marina, golf course and Mediterranean. Now that he knew they were on to him they could not afford to let him escape.
The man was wanted because he was suspected of being a member of a terrorist cell that had carried out a grenade attack in Paris.
But he had, according to French authorities, fled to the jihadist battlegrounds of Syria for almost a year and a half to escape arrest, and they feared he might be plotting a terrorist attack. After learning he was on his way back from Syria, they had put his father's building -- in Mandelieu-La Napoule, just up the coast from Cannes -- under surveillance in case he surfaced there, according to French security officials.
Their target -- Ibrahim Boudina, a 23-year-old French national born in Algiers -- had been detected crossing into Greece five weeks previously.
Greek border guards had found in his possession a USB stick with instructions for how to make homemade bombs "in the name of Allah," but had not apprehended him, according to investigators. Investigators did not explain why he was allowed to continue with his journey.
Details on the investigation are emerging at a time of sharply increased concern over the terrorist threat in France and other European countries. In the wake of U.S. airstrikes in Iraq and possible strikes in Syria, European counterterrorism services fear ISIS or its supporters could retaliate with attacks in Europe, a European counterterrorism official told CNN.
Following a long trail
According to French security officials, Boudina had set off for Syria in late September 2012 with a childhood friend -- Abdelkader Tliba, a French-Tunisian who worked as a cook in grand restaurants on the Cannes seafront -- just days after Jeremie Louis-Sidney, an alleged fellow member of their close-knit radical circle, had thrown a grenade into a Jewish grocery store in Sarcelles, a suburb of Paris, injuring a shopper.
Boudina, one of his friends later told French investigators, was longing to fight alongside jihadists in Syria, and had decided to leave before the dragnet came down, according to officials.
They left just in time.
On October 6, 2012, Louis-Sidney was killed in a shootout with police in Strasbourg after resisting arrest. Three days later, police recovered bags of potassium nitrate, sulfur, saltpeter, headlight bulbs and a pressure cooker belonging to Louis-Sidney's group in an underground car park in Torcy, a suburb east of Paris, according to prosecutors.
Investigators say they later ascertained their targets were likely Jewish organizations. French officials called the "Cannes-Torcy" group the most dangerous terrorist cell uncovered in the country since the 1995 bombing of the Paris metro. A dozen men allegedly belonging to the group were arrested and placed under formal investigation on suspicion of alleged terrorism offenses in the weeks following the attack.
Boudina and Tliba, who had shaved off his beard, traveled through Turkey, crossing the Syrian border near the Turkish town of Hatay, according to investigators. According to French officials, they first joined the Syrian al Qaeda affiliate Jabhat al-Nusra and then are suspected of joining the Islamic State in Iraq and Syria (ISIS), which now refers to itself as the Islamic State.
French security services believed they had allegedly linked up with jihadists after wiretapping Boudina's cell phone. By early 2013 they had obtained his Syrian number by obtaining a warrant to listen to his parents' phones, according to investigators.
DCRI listened in as Boudina made several calls back to his circle in France: if any others planned on traveling to Syria, they wanted to know about it, according to officials.
They were also worried the duo could pose a threat if they returned home, according to security officials. While they were in Syria, the two discussed the need to "punish" France on social media, according to officials. Their initial aim had been to die for the cause of holy war in Syria, a close member of their circle told investigators.
Soon after Boudina and Tliba fled France, police had discovered their last wills and testaments in the car of a friend, according to officials. "I really hope to find you in paradise, where you will be my queen," Boudina had written to his wife in a handwritten will, according to investigators.
According to officials, the same friend revealed during a series of interrogations with DCRI agents in October 2012 that Boudina and Tliba had been determined to fight in Syria ever since returning in early 2012 from a several-month-long trip to Cairo, where they had attended Islamic classes. Boudina now regarded it as his Islamic duty, the friend told the DCRI. The friend claimed their time overseas had radicalized them.
The friend described Boudina as a dominant figure in a small group of like-minded radicals who hung out together after prayers in mosques in the Cannes area. These drew congregants from tougher immigrant neighborhoods just miles from the glitz of the Cote D'Azur. To kick back, the group visited a nearby river. The beach was not an option because of the bikini-clad women.
The friend said Boudina tried to persuade him to travel with him to Syria, describing the paradise that would await them in the afterlife if they became martyrs and showing him videos of massacres carried out by the Assad regime. While the friend decided not to travel, he said another member of the circle joined them in Syria.
The friend told the DCRI that Boudina was supportive of a string of fatal terrorist shootings carried out by the French-Algerian extremist Mohammed Merah on French soldiers and Jewish schoolchildren in southern France in March 2012, according to investigators.
"Ibrahim said if he could not do jihad on Islamic soil he would do it in France. Ibrahim compared France to the head of the serpent, which you had to cut off," the friend told DCRI interrogators, according to sources. "Ibrahim spoke to me often about this Zionist area in Cannes and that if he could not go do jihad overseas it would for him be a target."
The net closes in
On January 16, 2014, 13 days after Boudina was detected reentering Europe at the Greek border, Tliba was arrested at the Italian port of Ancona during an identity check and transferred to French custody, according to officials. He also had been making his way back from Syria, according to investigators.
French security services feared the duo might have plans to launch an attack when they returned to France, according to counterterrorism officials, but had no idea what, if anything, was planned.
Boudina first went to ground in Nice, where he was put under surveillance, according to officials, before being traced to Mandelieu-La Napoule and his father's apartment complex.
As the clock ticked down to midnight on February 11, DCRI agents, in hot pursuit up the staircase, eventually caught up with Boudina between the 11th and 12th floors, and took him into custody.
Boudina was placed under formal investigation on suspicion of participation in a criminal conspiracy to prepare acts of terrorism. Tliba is also under formal investigation on the same count.
Both men deny the allegations against them. Their lawyers were unwilling to comment on the record to CNN. CNN contacted the prosecutor's office for comment on the case but received no reply.
Six days after Boudina was taken into custody, police made a startling discovery. In a storage closet for technical equipment on the 13th and top floor they found a handgun, bomb-making instructions, and three soda cans filled with the high-explosive compound TATP. Screws and nails were attached to one with sticky tape as shrapnel, according to sources briefed on the investigation.
French investigators maintain the items belonged to Boudina. French authorities suspect that in the 15 months Boudina spent in Syria, he learned how to make TATP, an unstable and difficult-to-transport explosive used to build detonators in multiple al Qaeda plots against the West, according to sources briefed on the investigation. Recovered from the cans were 950 grams of TATP, enough to cause significant destruction.
It is not clear whether ISIS signed off on his alleged plot. One possibility is that Boudina was allegedly acting on his own steam, having obtained the training he needed in Syria, given his alleged longstanding interest in launching attacks in France.
More than 800 French nationals have joined up with jihadist groups in Syria, according to officials. One former French ISIS recruit -- Mehdi Nemmouche -- allegedly shot and killed four people at a Jewish museum in Brussels in May, the first terrorist attack on European soil linked to the conflict in Syria. Nemmouche was arrested in France and extradited to face trial in Belgium. He has denied the charges.
With hundreds of jihadist veterans of Syria and Iraq already back on European soil, the fear is that the Brussels attack will not be the last.