Attack on train system sheds light on broad range of security threats to the Paris Olympics

The coordinated arson attack by suspected far-left anarchists on a high-speed train just hours before the opening of the 2024 Olympic Games in Paris illustrates the wide range of sophisticated security threats facing French security forces.

Potential threats to the event include a Russian-backed sabotage campaign, an attack directed or inspired by a Middle East-based terrorist group, and a cyberattack that could disrupt communications, according to several current and senior law enforcement officials in France, Europe and the United States.

So far, French authorities have not confirmed a motive, nor can they say whether the group responsible for the attacks on signals on the French rail network was coordinated by a foreign government.

Before the railway attack, the French interior minister said the authorities were convinced they had foiled four concrete and credible planned attacks on the Olympic Games – including one that may have been linked to Russia.

On Tuesday, three days before the opening of the Games, French police officers visited the home of a 40-year-old Russian, filed a complaint against him and took him into custody, the Paris public prosecutor’s office said.

“The elements uncovered in this investigation raise concerns that he intends to organize events likely to destabilize the Olympic Games,” the office told NBC News.

In another case, French Interior Minister Gerald Darmanin told a French news channel that an 18-year-old also arrested on Tuesday was part of another investigation into a terrorist organization and that authorities were combing through his electronic devices. “We believe there is a link” between the 18-year-old’s activities and a possible attack on the Games, Darmanin told BFM TV.

The arrests come amid a recent surge in terrorism and violence in France unrelated to the Olympics. The national anti-terrorism prosecutor told NBC News that a suspected terrorist was arrested last Friday after attacking a taxi driver in France’s Loire region. This was the fourth violent incident in the past two weeks. Several other incidents were investigated by law enforcement, including the deliberate ramming of a car into a cafe and the stabbing of a police officer in the neck outside the Champs-Élysées; police have not yet disclosed motives.

The heads of counterterrorism agencies, including the FBI in the US, have also warned of possible attacks worldwide by groups or individuals linked to or inspired by IS, including IS-K, which killed 145 people in an attack on a concert hall in Moscow in March.

A few years ago, France was the victim of two serious attacks linked to IS. In 2015, terrorists killed 138 people in Paris, including many in the Bataclan concert hall. And in 2016, a truck drove into a crowd in Nice, killing 87 people.

French and US authorities have cited minor incidents that have occurred so far in 2024 as examples of what could happen during the Games. These have included bombs detonated outside stadiums, attacks on easier targets such as bars and clubs, and several stabbings that are believed to be criminal or terrorist attacks.

Russian cyber threat

The Olympics rely on internet-connected systems to handle ticket and meal payments, athlete information and critical infrastructure such as the railway network, making France’s cyber network an attractive target for both lone perpetrators and state-backed hackers, law enforcement and cybersecurity officials warn.

Chris Krebs, who served as director of the Cybersecurity and Infrastructure Security Agency during the Trump administration, said he expected cybersecurity disruptions during the Olympics.

“I think it’s almost certain that Russian cyber actors, whether it’s the GRU, Sandworm or even the FSB, will try to do something related to the games,” Krebs, now chief information officer at cybersecurity firm SentinelOne, told NBC News.

Krebs pointed to previous attacks by Russian-backed groups involving propaganda, sabotage and the use of hacks and leaks, such as the one carried out in 2016 by the Russia-linked hacking group Fancy Bear. That group obtained and released health information from the World Anti-Doping Agency on prominent U.S. athletes, including gymnast Simone Biles. Biles and other athletes said they took medications for routine medical conditions and did not dope.

Krebs also pointed to the use of the “Olympic Destroyer” malware by Russian-backed hackers before and during the opening ceremony of the 2018 Olympics. The Justice Department later charged six members of Russia’s GRU intelligence agency for using the malware.

According to Krebs, the Russian-backed attacks are due to the West’s support for Ukraine after President Vladimir Putin launched a large-scale invasion of the country in 2022. He also said the Kremlin wants to tell the Russian people: “Look how messed up the West is.”

Russia is also carrying out so-called “gray zone attacks,” which involve attacks on European companies and infrastructure that support and ensure Ukraine’s defense against Russia.

In June, a man of Ukrainian-Russian nationality was arrested in a hotel in the French department of Val-d’Oise after he “suffered significant burns as a result of an explosion,” according to French authorities.

An official from France’s anti-terrorism prosecutor’s office said the investigation had found materials used to make explosive devices and that one of those devices had exploded. No other injuries were reported.

Several U.S. officials familiar with the incident said the detonated device contained the homemade explosive TATP, which has been used in terrorist attacks around the world, but particularly in Europe, over the past decades.

As NBC News first reported, U.S. officials said authorities believed the individual was planning to carry out a pro-Russian act of sabotage against a French facility supporting Ukraine’s war effort.

US and European officials say Russia is conducting a “brazen” sabotage campaign across Europe to damage railway lines, military bases and other sites that supply weapons to Kyiv, undermining Western support for Ukraine.

On Tuesday, a new arrest highlighted a possible attempt by Russian intelligence to disrupt the Olympics. French authorities said a man, whose identity they did not disclose, faces up to 30 years in prison on charges of “operating intelligence services for a foreign power with the aim of provoking hostilities in France.”

Several French news agencies report that the man is a Russian-born chef and a member of Russia’s domestic intelligence agency, the FSB. The French newspaper Le Monde reported that he once said: “The French will have an opening ceremony like no other.”

U.S. and European law enforcement officials say French law enforcement is also closely monitoring potential protest activity, ranging from local strikes to street demonstrations. Large climate-related protests, as well as demonstrations by pro-Palestinian groups, have occurred frequently, but French law enforcement is believed to be able to contain them.

Have the French learned from past attacks?

Some observers wonder whether French law enforcement authorities have learned from the bloody attacks in France in 2015 and 2016.

A review of French intelligence and law enforcement efforts following those two attacks revealed a number of gaps and oversights. NBC News obtained a trove of official documents in 2016 that were part of the French investigation. They showed that a suspect involved in the attack had been identified as early as 2009, but that French officials did not send undercover informants to record incriminating statements from the suspects – a practice long used by the FBI.

The French are now using undercover informants to thwart attack plans, as evidenced by the arrests of several people ahead of the Olympics. The attack on the Bataclan concert hall also highlighted the danger to first responders such as paramedics when suspects may still shoot, according to New York police and fire departments and other U.S. agencies that spoke to French officials after the attack.

Another lesson French authorities have learned is the importance of providing immediate support to attack survivors. “The government quickly understood the need to help victims after the Bataclan attack,” said Pauline Okroglic, a lawyer with the aid group France Victimes, whose 1,450 staff have assisted more than 300,000 victims of crime and national disasters since it was founded in 1986. The faster victims’ trauma was treated, the faster they recovered.

Jerome Moreau, a spokesman for the group, told NBC News that it works with “anyone who has had a traumatic experience” of an attack, from victims and their families to the families of perpetrators who were unaware of their loved ones’ plans. “The most important thing for us is to help every victim of a terrorist attack.”