Europe's free-travel zone is in crisis and EU leaders fear it may collapse. Photo / AP
Home-grown jihadists are able to travel freely from Syria to Europe because as few as one in 100 are checked against the EU's anti-terrorism watchlist in some countries.
Wanted terrorists carrying European passports can be waved through border checks with nothing more than a cursory visual inspection of their travel documents, sources have said.
And EU officials say they have no idea if any of the thousands of refugees coming into Europe are being scanned against the watchlist.
On average, just 10-20 per cent of EU nationals travelling from outside the continent have their passports checked against a Schengen-wide database designed to catch foreign fighters returning from Syria and Iraq.
At least three of the eight known Paris terrorists are believed to have fought in Syria before returning to commit Saturday's atrocity. All those identified so far are believed to be EU citizens.
It comes as European leaders warn that the Schengen free-travel zone is in crisis and will collapse as states throw up old border controls in the face of terrorism and a migration crisis.
The Schengen Information System (SIS) watchlist contains the details of 4000 foreign fighters, as well as hundreds of thousands of stolen passports, suspect cars, wanted criminals and missing people.
But there are gaping holes in SIS, thanks to an EU commitment to free movement, that have let wanted people slip through.
It is ultimately up to countries' security services how they use SIS for EU passport holders. But EU guidelines say that Europeans should be subject only to a "minimum check", including a "rapid and straightforward" inspection to check that their passport belongs to them.
Officials said the proportion of European passports cross-referenced against SIS ranges between countries from 1 per cent to 100 per cent.
The average across the EU is around 10-20 per cent. By contrast, British border officials are understood to check every traveller against SIS and other immigration and criminal databases.
European officials in charge of the system admit they have no idea how many - if any - of the thousands of refugees flooding into Greece and Hungary are scanned against SIS. They admit there is little chance of someone who crosses into Europe over a rural border being scanned.
Refugees are meant to be logged in Eurodac, a fingerprint database used for processing asylum claims, which police can access. However, fewer than one in 10 migrants in some areas of Greece are thought to have been registered this summer.
Even then, Eurodac cannot "talk" to SIS, meaning that even if suspected jihadists did register themselves as refugees on the Greek islands, the system would not flag them up as a threat.
Identity issues
Here's what we do and don't know about the rumours of Syrian refugee involvement in the Paris attacks.
• The passport is fake Authorities are pretty certain the passport, found near the body of an attacker who died during his suicide assault of France's national football stadium, is fake. It carried the name of Ahmad Almohammad, a 25-year-old Syrian.
French officials have indicated Almohammad was a loyalist soldier in the Syrian regime and died a few months ago. Serbian police arrested another man on Tuesday at a refugee camp carrying a passport with the same details.
It's not clear if he has any connection to the case, other than having used the same process of obtaining a forged passport. There is a great deal of precedent for migrants pretending to be Syrian to gain sanctuary in Europe.
• Fingerprints The passport, or at least a copy, was shown to Greek officials by someone on the island of Leros. On October 4, Greece issued a document to "Ahmad Almohammad" that would protect him from deportation for six months.
It's not clear yet whether the fingerprints have been matched to the dead assailant. If they do match, it still won't be immediately apparent if the man was a Syrian national.
• Identified assailants are European nationals
Although the Paris attacks appear to have been partially planned or co-ordinated by Isis operatives in the Middle East, all the identified assailants so far are citizens of EU countries.
This suggests their radicalisation was homegrown. Three out of the eight known assailants remain unidentified. Only one is known to be alive.