August 24, 2015

TSG IntelBrief: What the Foiled Train Attack Revealed

• The foiled attack on a Amsterdam-Paris high-speed train on August 21 revealed the vulnerability of non-aviation mass transit

• The incident also revealed the thin line between mass murder and minor injuries that are a hallmark of poorly planned lone wolf attacks; bystanders have very short windows in which intervention is possible

• The perpetrator was a ‘known wolf’—on the radar of several security services—highlighting the difficulty countries are having with monitoring the large numbers of potential threats

• Unfortunately, the sheer numbers of radicalized individuals in Europe, along with the persistent fighting in Syria and Iraq, mean more small cell or lone wolf attacks are highly likely.


The perpetrator of the foiled August 21 attack on a high speed train heading from Amsterdam to Paris says he only intended to rob the passengers, while the nature of his weaponry and his background strongly indicate terrorism. The ongoing investigations by French and Belgian authorities will uncover more details, but at this early stage one fact stands out: Ayoub El-Khazzani, a Moroccan native who has lived in Spain and France, was known to several intelligence and security services as a possible violent extremist. That Khazzani was able to board a train crossing the open borders of the EU with an AK-47 assault rifle, nine loaded magazines, a pistol, and a razor box cutter highlights serious issues the EU will need to address. The foiling of the attack by bystanders, however, highlights an unexamined aspect of recent lone wolf attacks.

Due to Khazzani’s suspected ties to violent extremists, Spanish authorities had placed him on a watch list, as French authorities later did. Khazzani joined an estimated 5,000 other suspected potential terrorists or extremists on France’s “S List”—a number that is already unmanageable and certain to grow as the entire continent deals with increasing radicalization. The challenge of such a list—and every nation has one—is that the individuals on it are simply suspected of having ties to violent extremism. The net is so wide that it catches the innocent and the guilty alike.

Based on information that is either prescient or foolish, authorities must decide whom to monitor and whom to merely place on the list. There is no way to effectively monitor even a fraction of the people on these terror watch lists, forcing authorities to prioritize threats with imperfect knowledge—the key challenge of preventative intelligence work. As with previous attacks, such as January’s Charlie Hebdo attack in Paris, people will question how a person known to authorities was able to move and operate without detection or disruption—a valid but misguided question.

Aside from the challenges of expanding terror watch lists, the foiled attack demonstrated a serious, though understandable, vulnerability in the security of non-aviation mass transit. Hundreds of thousands of people in Europe board the continent’s various well-regarded train systems. Within the EU, such open travel is a hallmark of the relatively borderless construct, though one that unfortunately might need adjustment given that the threat of more attacks will only increase. The financial costs of installing X-ray machines, metal detectors, and the personnel needed to operate them, will be immense—as will the cultural and societal costs needed to adjust to restrictions forced on free people. Europe has dealt with spasms of terrorism in the past and will handle this immediate and near-term threat, hopefully balancing security and personal liberty concerns.

The very fact that the attack was foiled highlights an interesting aspect of poorly planned and executed attacks by individuals or small groups. Spectacular terrorist attacks involving massive explosives and simultaneous attacks with multiple trained assailants are by design almost impossible to minimize once initiated. A bystander is not going to stop a car bomb from exploding. But with these recent lone wolf attacks, there is a very small window of opportunity in which to prevent greater tragedies. On the train last Friday, several passengers— three Americans and one Briton—moved immediately towards the threat as soon as it emerged. Closing in on an attacker who is readying himself to shoot is not an easy thing to contemplate, let alone initiate, yet it is the only way to stop the massacre in its tracks. Particularly in the case of an assault rifle, once the assailant has it in battery and is firing, there is very little hope of closing the distance without being cut down. It is within the fumbling first seconds that the chance for disruption is found. Since these attacks are the product of intense motivation but little rehearsal, there will likely be such fumbling in the first few seconds.

This is the thin line between success and failure inherent that is in these new low-scale, high-impact ‘spectacular' attacks. Single attackers—or perhaps two or three—can be overpowered by a similarly small number of people possessing great courage. The chances of quickly and effectively disrupting an attack by a person more motivated than skilled are higher in these inspired attacks than in those that are more directed.


For tailored research and analysis, please contact:


Subscribe to IB