Authorities are beginning to piece together a clearer picture of 25-year-old Moroccan Ayoub El Khazzani, who was last seen in pictures on social media on the floor of the train with his arms tied behind his back after three American passengers tackled him as he fired a gun and carried a blade.
French counter-terrorism officers were on Sunday questioning him as it emerged he had been flagged by intelligence services in at least four European countries.
According to an initial probe, Khazzani has denied any intention of waging a jihadist attack, saying he had merely stumbled upon a weapons stash and decided to use it to rob passengers.
Sophie David, a lawyer assigned to his case at the beginning of his detention in Arras but who is no longer representing him, said he denies firing a single shot.
“He is dumbfounded that his act is being linked to terrorism,” she told French television station BFM-TV.
But he was flagged as a radical Islamist by intelligence services in several countries, and French investigators are focusing on an extremist attack.
Under French law, suspects in probes related to alleged terrorism can be questioned for up to 96 hours, which means Khazzani could remain in custody until Tuesday evening.
Khazzani's case also illustrates the near-impossible task that authorities in Europe face in keeping tabs on hundreds of extremists, many of whom have returned from Syria after fighting for the Islamic State group, or ISIS.
Spanish intelligence services had flagged up to their French counterparts as long ago as February 2014 that he was an Islamic extremist.
French Interior Minister Bernard Cazeneuve said that information led to him being placed on a list “so that we could locate him if he ever came on to French soil”.
The minister said Khazzani “lived in Spain in 2014 then in Belgium in 2015”.
A source close to the inquiry said: “This man lived in Belgium, got on a train in Belgium with weapons that he had undoubtedly acquired in Belgium, and he had identity papers from Spain.”
His Spanish residency permit gave him access to the 26 European countries that make up the visa-free Schengen zone.
“He was able to move around freely,” the source said.
Khazzani caught the attention of security services in each of the countries he visited.
In Spain, he was said to have been heard calling for jihad in fiery speeches in mosques in the southern town of Algeciras. He also had a reputation for dealing drugs.
A Spanish anti-terrorist source told news agency AFP: “He lived for seven years in Spain, first in Madrid and then in Algeciras, from 2007 to March 2014 when he moved to France.”
“Once he was in France, he then travelled to Syria, before returning to France,” the Spanish source said.
At the beginning of 2014, Madrid had tipped off French intelligence that Khazzani was about to enter France, but his location was never pinpointed.
“The French say they had no more information about him until May 10, 2015,” another source said.
On that date, they were informed by their German counterparts that Khazzani was about to fly from Berlin to the Turkish city of Istanbul, a French intelligence official told AFP.
Soon afterwards, Spanish authorities told France that he had moved to Belgium. Belgian Justice Minister Koen Geens said he was “known” to the country's intelligence services.
Yet Belgian Prime Minister Charles Michel said in a TV interview Saturday that the information about him was sketchy at best.
“There was no material proof or concrete evidence that allowed us to find him, to know exactly when he lived in Belgium. He seemed to be someone who travelled around within Europe.”
On Friday, Khazzani boarded the packed train in Brussels carrying an arsenal of a Kalashnikov rifle, an automatic pistol, ammunition and a blade.
It appears that only the intervention of the Americans, two of whom were servicemen, prevented a bloodbath.