An undated photo released by a social network shows the 25-year-old Moroccan suspect in Friday's shooting, named as Ayoub El-Khazzani, who was overpowered by two US servicemen and other passengers before he could kill anyone during an attack aboard an Amsterdam-Paris Thalys train on August 21, 2015. He lived in (southern) Spain in Algeciras for a year, until 2014, then he decided to move to France. Once in France he went to Syria, then returned to France, according to a Spanish anti-terror source.
What do we know about the France train gunman?
02:06 - Source: CNN

Story highlights

Ayoub el-Khazzani was taken into custody on train going to Paris

He allegedly claims Paris ringleader ordered him to kill Americans

CNN  — 

The alleged ISIS terrorist charged with launching a gun attack on a high-speed train last year that was thwarted by three Americans has finally started cooperating with French authorities, a source close to the investigation tells CNN.

Ayoub el-Khazzani, an alleged Moroccan ISIS recruit, was taken into custody after being restrained by a vacationing US airman, a US National Guardsman and their friend on a Thalys train traveling between Amsterdam and Paris on August 21, 2015. He began speaking openly to French investigators last week, the source told CNN.

El-Khazzani claimed the ringleader of the Paris attacks, Abdelhamid Abaaoud, personally instructed him to kill Americans on the train.

The Hungarian counterterrorism center TEK had already established that Abaaoud and el-Khazzani traveled to Europe together just weeks before the train attack, arriving in Hungary on August 1, according to a detailed report published last month in the terrorism studies journal CTC Sentinel. Those revelations were featured on the front page of Le Monde and other French newspapers.

According to Le Monde, it was this media coverage that probably prompted el-Khazzani to open up to authorities last week.

But in an extraordinary sign of the slow pace of intelligence sharing between European agencies, French investigators had not yet been sent the Hungarian file at the time of these disclosures, despite requesting the information.

After the CTC Sentinel study was published its co-author Jean-Charles Brisard, the director of the Center for the Analysis of Terrorism in Paris, shared the documents with French authorities, after he learned they had not yet received them from the Hungarian government, he told CNN.

In his confession, el-Khazzani said he spent just six days in Syria in May 2015, during which time he spent time in a training camp learning to handle a Kalashnikov after being persuaded to return to Europe to launch an attack by a masked fighter, the source close to the investigation told CNN.

The following account of the confession, first reported on by Le Monde on Monday, is based on information from this source.

After his weapons training in Syria, el-Khazzani said he was driven back to the Turkish border and told to await instructions in Istanbul, the source told CNN. After el-Khazzani was twice refused on board flights to Albania from Turkey because he did not have the necessary identity papers, his handler in Syria told him to await the arrival in Turkey of Bilal C. a young Algerian ISIS operative who had been dispatched by Abaaoud to find a way to infiltrate operatives through the refugee corridor running between Turkey, Greece and the Balkans.

Bilal C. told el-Khazzani to stay put, while he explored the routes. According to the report published by CTC Sentinel, “the scouting mission took Bilal C. from Syria to Turkey, Greece, the Republic of Macedonia, Serbia, Hungary and Austria. During his trip, the Algerian continuously informed Abaaoud on any open border crossings, waiting times, and arrival and departure routes.”

El-Khazzani said that a few days after Bilal C. came through Turkey his handler in Syria contacted him again to tell him another “brother” would be joining him in Turkey to make the trip. This was Abaaoud. Exploiting the refugee flows and Bilal C’s scouting, the two men then traveled into Europe along the migrant corridor to Hungary, before splitting up in Budapest and traveling separately to Brussels.

In the Belgian capital, Abaaoud and el-Khazzani went to ground in a small apartment, where el-Khazzani said he used to cook for a small group of ISIS terrorists that included the scout Bilal C., who had himself entered Hungary on July 16, 2015, according to the Hungarian investigation, before linking up with el-Khazzani in Vienna.

Soon after their arrival, Abaaoud told el-Khazzani and Bilal C. he had received orders from Syria indicating he and the Algerian ISIS scout needed to start psychologically preparing for an operation, but at that point, according to el-Khazzani, Bilal C. got cold feet and fled the apartment, making Abaaoud limit his time at the property anxious he would give them up to authorities.

Bilal C. was arrested in Germany a year later – in July 2016 – and is awaiting trial on charges of “supporting a terrorist organization.”

A week before the train attack, Abaaoud told el-Khazzani the operation was imminent and he would prepare everything for him. And then a few days later, Abaaoud told him the target was a Thalys train and his task was to attack Americans on board, el-Khazzani claimed.

El-Khazzani also made the seemingly far-fetched claim that Abaaoud had told him there would be three to five American soldiers in the first-class carriage on the train. There would have been little way for Abaaoud to have had such information ahead of time. (Abaaoud died in a dramatic police raid following the Paris attacks.)

Other ISIS operatives arrested in the West have shaped their accounts to suit their interests, complicating the task of investigators.

CNN terrorism analyst Paul Cruickshank is editor in chief of CTC Sentinel, the flagship independent terrorism studies journal of the Combating Terrorism Center at the US Military Academy at West Point and is on the advisory committee of the Center for the Analysis of Terrorism in Paris.