The High-Speed Rail Attack in France

The following article was authored by the Mineta Transportation Institute’s Brian Michael Jenkins, Director of the Mineta National Transportation Safety and Security Center, and Bruce R. Butterworth, a Mineta Research Associate.

In light of the recently prevented attack on a high-speed train in France, many people are asking if security should be re-evaluated. Does the incident indicate increased risk? How might increased security measures affect passenger operations and convenience? Given the large crowds, would any screening be practical? And even if attackers are not on the train, couldn’t they simply blow up the tracks in some remote area?

First, let’s review the incident. On Friday, August 21, a man carrying weapons in his luggage boarded the high-speed Thalys train in Brussels, heading for Paris. (It is not yet clear how he carried the weapons on board.) This route is a straight run from Brussels to Paris that takes 82 minutes. As the train entered northern France near Oignies, the man emerged from the lavatory of coach 12 carrying a loaded AK-47.

According to initial reports, he fired several shots, wounding one passenger, before being tackled by two Americans. A third American and a British passenger assisted in disarming the gunman. During the melee, one of the Americans suffered slash wounds from a box cutter carried by the gunman. This episode underscores the point that, as with airline hijackings today, sometimes it is up to the passengers to neutralize an attacker.

The armed man was subsequently identified as Ayoub Khazani (or El-Khazzani), a 25-year old Moroccan national believed to be living in Belgium. In addition to the AK-47, Khazani had nine magazines of ammunition, each holding 30 rounds, giving the gunman 270 shots. Khazani also carried a Luger semi-automatic pistol with extra ammunition.

Initial media accounts often turn out to be inaccurate or incomplete, but European authorities reportedly suspected Khazani of being an Islamic extremist. The security services in Spain, where Khazani had been living since 2007, notified French authorities in February 2013 that he might be heading to France. French authorities put his name on a watch list, but there is no evidence of his having gone to France.

Instead, he appears to have gone to Brussels where he was living up to the time of the attack. However, German authorities believe that Khazani took a flight from Germany to Istanbul in May 2015. It is not clear yet whether he was able to cross the Turkish border into Syria.

Some reports indicate that Khazani may have been linked to a group of French supporters of the Islamic State of Iraq and the Levant (ISIL) residing in Turkey. One French account also linked

Khazani to a suspected Islamist shooting in Belgium in January 2015. Khazani is currently in custody and being questioned by French authorities while investigations continue.

The assailant’s intentions appear to be terrorist.

Khazani’s sizable arsenal and suspicious background suggest that he intended to carry out a terrorist attack aboard the speeding train during its longest non-step leg. Had he not been quickly disarmed, he would have been able to shoot dozens of passengers before the train could stop and police were able to board the train. As in the case of Amedy Coulibaly’s takeover of a kosher supermarket in Paris in January 2015, a lengthy hostage siege may have been part of the plan.

Through his attorney, however, Khazani claims that he intended only to rob passengers, not kill them. His attorney further claims that Khazani says he found the weapons abandoned in a suitcase near the park bench in Brussels where he was living as a homeless person. Although it is impossible to offer a final judgment at this time, these claims seem far-fetched. Did he need so much firepower to do so?

Another question is why Khazani would plan to initiate the robbery on the longest non-stop leg. Did he plan to rob passengers and then wait an hour until the train arrived in Paris? Or did he plan to pull the emergency cord and run off into the French countryside with his weapons and loot? Khazani reportedly watched a jihadist video just before the attack. French authorities do not believe that his intentions were to carry out a robbery. They have charged him with attempted murder related to terrorism.

Khazani does have a criminal record with multiple arrests for drug-related offenses. That has been the case with many of the jihadists involved in recent terrorist attempts in Europe. Sid Ahmed Ghlam, arrested in April 2015 while planning to blow up a church near Paris; the Kouachi brothers, who attacked the offices of French newspaper Charlie Hebdo in Paris; Amedy Coulibaly, who carried out a simultaneous attack at a kosher supermarket; Mehdi Nemmouche, who attacked the Holocaust Museum in Brussels; and Mohammed Merah, who carried out a series of killings in southern France in 2012, all had records for armed robbery, drug related offenses, or other crimes.

Despite stricter controls on guns than those of the United States, criminals and terrorists in Europe seem able to readily obtain weapons. The Kouachi brothers, Coulibaly, and Nemmouche also were able to obtain AK-47s. These weapons, many of which come from the Balkans, can be purchased on black markets. Many of France’s terrorists had criminal connections. The free circulation of people and goods in Europe has made it very difficult to suppress the illegal weapons trade.

Armed assaults on passenger trains and stations are an attack method.

Bombing remains the terrorists’ preferred mode of attack. A majority of terrorist attacks on trains and stations involve bombs, some of them resulting in heavy casualties. This is evidenced in the 2004 attack on commuter trains in Madrid, which killed 191 people, and the 2005 suicide bombings of the tube and a bus in London, which killed 52 people in addition to the bombers themselves.

Shootings aboard trains appear to be rare. The Mineta Transportation Institute’s database of 4,158 terrorist attacks and serious violent crimes against public surface transportation shows only four armed assaults on board—as opposed to attackers shooting at—passenger trains. By contrast, there were 66 incidents of shootings at passenger trains, including a few against tourist trains.

One of these was the 1993 shooting on board the Long Island Railroad by Colin Ferguson. He was not a terrorist, but a mentally disturbed individual who killed six people and wounded 19 others. He too was tackled and disarmed by fellow passengers. There were nine other incidents in this narrow category, ranging from six attacks with some injuries but no fatalities, to a 2014 stabbing spree on a rush hour Taipei subway train, killing four and injuring at least 21, to the most lethal train attack ever—the February 2003 arson-suicide attempt on a subway train in Daegu, South Korea, in which 198 people were killed and around 150 injured. These attacks help us remember that the mentally deranged can be as lethal, if not more so, than terrorists where trains and buses are concerned.

The MTI database also includes a number of armed hijackings of trains. Nearly 40 years ago, seven South Moluccan extremists on December 2, 1975 seized a passenger train in the Netherlands. The hostage siege lasted eleven days, during which the terrorists killed three of their hostages before surrendering. In 1977, South Moluccan terrorists took over another train. This time the siege lasted 20 days before Dutch marines stormed the train. In all, two hostages and six terrorists died during the episode.

In the wake of this latest incident, European officials will no doubt increase security measures to keep armed individuals off trains. However, terrorist assaults also take place in train stations. (MTI’s database shows that 77 percent of the assaults occur on trains, with 23 percent in train stations.)

The MTI database also shows 126 incidents primarily involving armed assaults, stabbings, armed hijackings, and armed robberies (the last category obviously does not capture all robberies) on board passenger trains and at train stations. More than one-half of these have occurred in India, Pakistan, and Thailand. Only eight of these over the 45-year period have occurred in Western Europe or North America.

While jihadists carried out only three of the shooting attacks against surface transportation, including the deadly 2008 Mumbai train station attack, the average number of fatalities in these attacks was nearly twenty, versus the overall average of four fatalities per attack.

Radicals still can operate under the radar.

This incident underscores a number of security issues. Officials now estimate that as many as 5,000 individuals have gone from Europe to join jihadist fronts in Syria and Iraq. Most of these are from France, Belgium, Germany, and the United Kingdom. Hundreds have returned, some determined to continue violent campaigns at home.

It is not that they are being radicalized and trained for violence in the Middle East and sent back to carry out attacks, although that threat may increase in the future. Rather, travel to the Middle East is evidence of their radicalization and, for some, reinforces their determination. At the same time, ISIL, al Qaeda, and other affiliated jihadist groups are constantly exhorting those at home to carry out attacks. Homegrown jihadists—who in Europe probably number in the thousands—and who cannot make it to Syria still represent a potential threat. Recent terrorist attacks and attempts in Europe indicate a terrorist campaign, unorganized rather than centrally directed. It is likely to continue.

In the Khazani case, an individual known to the authorities in several European countries was apparently able to travel from Spain to Germany to Turkey to Belgium, acquire weapons (assuming Khazani did not find his weapons in an abandoned suitcase) and board a Paris-bound train without being identified. Part of the problem is that European authorities are overwhelmed with the large number of suspects who appear on their radar. It requires enormous resources to keep people under long-term continuous surveillance, and it is difficult to predict who is likely to turn violent.

There is a further difficulty. Europe is still working to coordinate intelligence services and law enforcement organizations necessary to effectively respond to the new threat. Individuals and goods cross Europe’s internal borders more easily than information about terrorist suspects. It is as if in the United States there were fifty separate FBI agencies, each reporting to a separate state authority with different ideas about how terrorism should be dealt with. Sharing information is possible, but it is not seamless or simple.

Screening would be challenging.

Members of the European Union have agreed to share Passenger Name Record (PNR) information, which covers airline passengers. However, most Europeans travel across national frontiers by train, which does not require identification before purchase or boarding. Some type of identification requirement for international travel within Europe could be imposed, allowing names to be checked against watch lists, as they are for airline travel, but this would require new information architecture. Such a proposal would also run into strong political resistance. Moreover, it would not prevent terrorists from attacking crowded metros, commuter trains, and stations.

Passenger screening may be introduced. It exists now for passengers traveling on the Eurostar between Paris and London and to a lesser degree for some trains in Spain. To screen all passengers on all international train routes would require a significant investment and would likely run into even fiercer political resistance. Unlike commercial airports, which—even before security was introduced—generally channeled passengers into lines and toward departure gates, train stations offer multiple access points. And passenger screening could create long lines of waiting passengers, disrupting train travel and, perhaps most important, creating lucrative targets that terrorists can easily attack. Some U.S. subway and commuter train operators have introduced random screening, which can be ramped up during periods of high threat.

While trains do not have the same allure to terrorists as aviation, they are still valuable targets. It is always difficult to defend public places, but when frightened by the possibility of terrorist attack, people can avoid restaurants, theaters, department stores, and other public venues, as they did during terrorist bombing campaigns in Belfast, London, and Paris.

Ridership on public transportation falls immediately after terrorist attacks, but people still must travel to work, and often subways and commuters trains are the only practical means. Hitting transport, therefore, has a psychological and economic benefit to the terrorists when they hit a transportation mode that is used the most, as rail is in Europe and in certain Eastern U.S. cities.

Terrorists face tradeoffs in choosing whether to attack train stations or trains. An attacker seeking to maximize fatalities might choose a train because passengers have no means of escape, and there is less likelihood of armed responders being on board. On the other hand, stations offer ready access with little scrutiny and easier escape through crowds of people. The two-man terrorist team attacking Mumbai’s Central Rail Terminal in 2008 were able to kill 56 people. Like Khazzani, they both were armed with Pakistani versions of the AK-47 and pistols

Choosing high-speed trains offers terrorists iconic targets, while attacking commuter trains and metros offers denser concentrations of people. However, with the exception of the facilities for the Eurostar, European stations are configured to provide maximum convenience to passengers transferring to and from high-speed systems to local commuter lines. This makes separate security arrangements difficult to implement, and it disrupts travel.

Alert passengers can help, but difficult security decisions must be faced.

Authorities in Europe may deploy more uniformed security personnel and plain-clothes police to respond immediately to threats on trains and in stations. This has been the approach taken by France, which has deployed thousands of police and soldiers in response to terrorist threats. The effect, if any, will be more as a deterrent because the great number of trains to be covered and the number of coaches in each train will limit coverage to a small percentage of the volume. Much will depend on the immediate response of threatened passengers. The actions of the brave American and British passengers who tackled and disarmed Khazani may be inspirational.

Europeans may collectively decide—if only by default—that beyond temporarily increasing security with the visible presence of armed guards, the risks created by the terrorist threat does not warrant fundamental changes. Nevertheless, the potential carnage, narrowly avoided, should serve as an impetus for a thorough review of transportation security measures.

PREVIOUS TRANSPORTATION SECURITY PERSPECTIVES

All papers are available for free download and no registration:

• Troubling Trends Emerge in Terrorism and Attacks on Surface Transportation;

• By the Numbers: Russia’s Terrorists Increasingly Target Transportation;

• Mineta Transportation Institute Says Subways Are Still in Terrorists’ Sights;

• The Breach of Security at San Jose’s Airport Raises Broader Issues;

• The Terrorist Attack in Kunming, China: Does It Indicate a Growing Threat Worldwide?;

• A Terrorism Analysis of the April 14, 2014, Bus Terminal Bombing in Abuja, Nigeria;

• Suicide Bombings Against Trains and Buses Are Lethal but Few in Number.

ABOUT BRIAN MICHAEL JENKINS

Mr. Jenkins directs the Mineta Transportation Institute’s National Transportation Safety and Security Center, which focuses on research into protecting surface transportation against terrorist attacks. He is an international authority on terrorism and sophisticated crime. He has authored several books, chapters, and articles on counterterrorism, including International Terrorism: A New Mode of Conflict and Will Terrorists Go Nuclear? And When Armies Divide, a discussion about nuclear arms in the hands of rebelling armies.

ABOUT BRUCE R. BUTTERWORTH

Mr. Butterworth is a research associate at the Mineta Transportation Institute. He has worked at congressional, senior policy, and operational levels, including with the House Government Operations Committee, Department of Transportation, and the Federal Aviation Administration, where he was senior-level Director of Policy, and then Director of Operations. Amongst other tasks, he helped managed the resolution of aviation security crises and launched a program of dangerous-goods regulation and cargo security after the 1995 ValuJet crash. He has published extensively on transportation security.

ABOUT THE MINETA TRANSPORTATION INSTITUTE

The Mineta Transportation Institute (MTI) conducts research, education, and information transfer programs regarding surface transportation policy and management issues, especially related to transit. Congress established MTI in 1991 as part of the Intermodal Surface Transportation Efficiency Act. MTI won national re-designation competitions in 2002, 2006 and 2012. The Institute is funded through the US Department of Transportation, the US Department of Homeland Security, the California Department of Transportation, and public and private grants. The internationally respected members of the MTI Board of Trustees represent all major surface transportation modes. MTI, the lead institute for the nine-university Mineta National Transit Research Consortium, is affiliated with San Jose (CA) State University’s College of Business. Visit transweb.sjsu.edu