El Khazzani, 26, is a Moroccan citizen, Belgium’s chief prosecutor told NBC News. The prosecutor said the question now is: Was he working alone or with accomplices, as part of a broader network?
French Interior Minister Brenard Cazeneuve said Saturday that El Khazzani had been previously flagged by Spanish authorities in 2014 for his radical Islamic ties; and he attempted to go to Syria in May, though it’s unclear if he was successful, according to the Wall Street Journal.
The attack of which El Khazzani is accused happened just before 6 p.m. local time, near the French-Belgian border, and was thwarted by the quick-thinking work of four men, including two American servicemembers and their childhood friend and a British man.
Witnesses and officials have said the man (allegedly El Khazzani) was shirtless and carrying an AK-47, a handgun and a box cutter, as well as approximately 300 rounds of ammunition.
The man was surprised by someone entering the train bathroom and began to fire, at which point the four – Anthony Sadler, Chris Norman, National Guardsman Alek Skarlatos and U.S. Airman Spencer Stone – jumped into action.
The man was soon detained. Three people were injured (including Stone), but none were killed.
A lawyer initially assigned to El Khazzani’s case following his detention told France’s BFM that “He is dumbfounded that his act is being linked to terrorism.”
She said he describes himself as homeless and that he found the rifle in a suitcase in a Brussels park where he sometimes sleeps.
El Khazzani denies firing at all, his initial lawyer said, according to The Telegraph, citing the AFP.
But El Khazzani was already known to American intelligence at the time of the attack, a source told PEOPLE.
“A foreign intelligence service had him on their radar screen. They notified other agencies. Because of our relationships with foreign agencies, the suspect came on our radar, as well,” an American counterterror official says. “He was known to us.”
Still, officials – including the White House – have stopped short of calling the attack an act of terrorism pending the investigation.
•Reporting by SUSAN KEATING