The media is rife with speculation about the motives of the Moroccan gunman who attacked a Paris-bound train Aug. 21. Ayoub el-Khazzani, who was subdued by three American tourists aided by a British man living in Paris, brought an AK-47, a pistol and a box cutter onto the train. A narrative has emerged that he was not a jihadist bent on conducting a terrorist attack but merely a thief intending to rob the train. But the sequence of events, the hundreds of rounds of ammunition he carried and his background as a known extremist — not to mention the difficulty of escaping a train with stolen goods — make it clear that the incident was indeed a failed terrorist attack rather than an armed robbery gone bad.

The Aug. 21 attack fits into several analytical narratives that Stratfor has been following. First, it highlights the vulnerability of rail transit; trains and subways continue to provide soft targets for would-be attackers. As we have previously discussed, rail transit is an enticing target for a terrorist attack because it offers a dense concentration of potential victims, neatly packaged into a small metal box. It simply is not economically feasible to implement airport-like security measures for high-volume train lines, so they will therefore remain vulnerable soft targets for the foreseeable future.

Second, the would-be attacker was known to security agencies in Spain and France. The number of potential attackers at any given time is very high, especially in Europe, and authorities simply do not have the resources to place them all under constant surveillance. Surveillance efforts must therefore favor operatives who are considered to be the most dangerous. This means that some possible assailants will continue to slip through the cracks.

Third, the attacker was able to obtain weapons in Belgium. Several attacks, including the Charlie Hebdo attack in Paris on Jan. 7, and thwarted plots have been carried out with weapons obtained on the Belgian black arms market.

Fourth, although the attacker allegedly had traveled to Syria — ostensibly to obtain military training at a jihadist camp — he was not highly trained. After his first few shots, his AK-47 malfunctioned and he struggled to clear it. This malfunction gave the three Americans and the Briton time to rush and disarm him. Had the weapon not malfunctioned, the men may have had to charge into a hail of fire. In many leaderless resistance cases involving lone operatives, attackers are unprofessional and struggle to conduct successful attacks. There is a report that the gunman first appeared near the train's engine and perhaps intended to conduct some sort of train hijacking, but the crew was able to lock him out of the compartment.

Finally, the Americans and the Briton who rushed and disarmed the gunman are prime examples of what we refer to as grassroots defenders. When confronted by danger, they possessed the proper mindset to charge the gunman instead of freezing or sitting by passively in denial, waiting to be shot. Had they hesitated and given the gunman time to clear the malfunction in his AK-47, the story in the news today may have been far more tragic.

This article originally appeared on Stratfor.com