PARIS — The shooter boarded the packed high-speed train with enough firepower to slaughter dozens in a matter of minutes, and he was foiled not through high-tech security but because two vacationing American service members happened to be there to overpower him.

Now sharp questions are being asked about Europe’s security measures after a man who had been flagged by counterterrorism authorities as a potential risk was allowed onto the continent’s vital rail system without any security checks. Spanish, French and Belgian security officials had the man, identified as 26-year-old Moroccan citizen Ayoub el-Khazzani, on their radar for more than a year.

Spencer Stone waves as he leaves the police station in Arras, northern France, on Saturday. Stone is one of the passengers credited with subduing a gunman. The Associated Press

The Americans – Airman 1st Class Spencer Stone, and his childhood friend Spec. Alek Skarlatos, who just returned from a deployment in Afghanistan – are being lauded as heroes along with a third American friend and a British consultant who teamed up to subdue the assailant. But European leaders called for swift measures to improve security so that they would not need to rely on luck to thwart a shooting that could quickly have become as bloody as the January terrorist attacks in Paris that claimed 20 lives, including the three gunmen.

French Interior Minister Bernard Cazeneuve said Saturday that the suspect was believed to have been a member of “the radical Islamic movement.” French and Belgian authorities both mobilized thousands of security officers to patrol trains and train stations on Saturday. In densely-populated Europe, high-speed trains are as critical to travel as planes are in the United States – but on most routes there are no X-ray machines or metal detectors, and it is possible to buy tickets without providing identification.

SUSPECT PICKED UP FOR DRUG TRAFFICKING

French investigators have identified the attacker as el-Khazzani, an official with knowledge of the investigation said, speaking on condition of anonymity because he was not authorized to speak about it. El-Khazzani lived in Spain until March 2014 in the southern city of Algeciras, where authorities had picked him up for drug trafficking and noted that he attended a mosque with ties to Islamist militancy.

Spanish authorities had notified other European security agencies when el-Khazzani left Algeciras, and he was added to watch lists in both France and Belgium, according to authorities in both countries. The French designation flagged him for heightened scrutiny when he entered and exited borders. But there are about 5,000 people on the list, far too many to monitor around the clock, security analysts said.

European authorities have long struggled to know when to act on intelligence that they have collected. The three men behind the January attacks in Paris on the Charlie Hebdo newsweekly and a kosher supermarket had been subject to extensive surveillance over concerns they were plotting attacks, but the monitoring was eventually dropped.

The suspect in Friday’s attack had been flagged by other European counterterrorism authorities as a potential jihadist, but “he was not known as someone dangerous,” Belgian Justice Minister Koen Geens told reporters in Brussels. “We get a lot of these names,” he said, saying that it was important to balance monitoring with privacy concerns.

SUSPECT HAD TRAVELED TO TURKEY

European security authorities had noticed that el-Khazzani traveled to Turkey from Berlin in May, the French official with knowledge of the investigation said. Turkey has a porous border with Syria, and it has become a conduit for Islamist militants traveling in and out of the fighting there. But it is also a popular European vacation destination.

Spanish security officials believe that el-Khazzani traveled from France to Syria and back last year, the Spanish newspaper El Pais reported. Belgian newspaper Le Soir, meanwhile, said that Belgian authorities believed he may have had connections to a large Islamist militant ring broken up there in January.

In the end, the suspect slipped onto the train on Friday afternoon unnoticed, with a prodigious armory: nine spare clips for his Kalashnikov in his backpack along with a 9mm pistol and a box cutter. The attacker was in the bathroom when he was discovered by a French citizen. The man tried to subdue the attacker, but was thwarted by gunshots, Cazeneuve said.

That’s when the Americans sprang into action. Spencer Stone, an Air Force serviceman who is stationed at Lajes Air Base in the Azores, heard the first shots go off and ran toward the attacker, said his friend Skarlatos, a member of the Oregon Army National Guard.

“Spencer ran a good 10 meters to get to the guy, and we didn’t know that his gun wasn’t working or anything like that. Spencer just ran anyway, and if anyone would’ve gotten shot it would’ve been Spencer, for sure,” Skarlatos told French television networks on Saturday.

Stone got the suspect into a headlock, while Skarlatos said he grabbed the suspect’s pistol and threw it away. Then Skarlatos took the man’s rifle and started beating him with it. During the fracas, the suspect managed to injure Stone in the hand and neck with a box-cutter, French authorities said.

‘IT’S A MIRACLE THE ATTACK FAILED’

Another childhood friend, Anthony Sadler, a student at California State University at Sacramento, joined to help restrain the suspect, as did British businessman Chris Norman, 62.

“We managed to get him under control,” Norman told reporters in Arras, France, on Saturday. “It’s a miracle the attack failed. I think his gun was jammed.”

The men managed to hogtie the assailant and subdue him, he said. A shaky cellphone video of the outcome showed the trussed man, shirtless and in white pants, lying facedown on the floor of the train car, his legs tied up in the air.

Sadler told French television journalists that even though Stone was injured in the scuffle, he went to aid an injured passenger.

“Without his help he would’ve died. That man was bleeding from his neck profusely,” Sadler said.

Skarlatos “just recently returned home from Afghanistan,” said his stepmother, Karen Skarlatos, by telephone. “He got home in July. He spent the greater part of a year over there. He has a warrior’s heart. He’s just a strong brave guy.” She said he had been stationed outside of Bagram air base.

Skarlatos studies at a local community college and works part time at a Costco, his stepmother said.

Stone was treated and released on Saturday, according to U.S. officials. He waved at journalists when he was released from a hospital in the northern French town of Lesquin, his left hand bandaged and his arm in a blue sling.

The men who foiled the attack received phone calls of congratulations and appreciation from both President Barack Obama and French President François Hollande on Saturday, the offices of both leaders said. Obama and Hollande also spoke to each other.

“The president expressed his gratitude to these three individuals for their heroic actions forestalling an even greater tragedy,” said White House deputy press secretary Eric Schultz in a statement. Obama “expressed how proud all Americans are of their extraordinary bravery,” Schultz said, adding that Obama wished Stone a full and speedy recovery.

In a tacit acknowledgment that security lapses may have led to the attack, Belgian Prime Minister Charles Michel on Saturday called for a multinational meeting of top security officials to tighten identity and baggage checks on the trains.

Despite the French and Belgian promises of stepped-up security, on one Saturday high-speed train trip between Brussels and Paris – the same route on which the attack took place – there were no special bag screenings, identity checks or uniformed security officers visible on the train. On many routes, trains leave once an hour or even more frequently. Instituting special security screening would require a significant new commitment of resources.

Washington Post staff writer Peter Holley in Washington contributed to this report.

Related Stories