How difficult would it be to place a bomb on a bus or train in the United States? Not very difficult at all, an ABC News investigation found.
An ABC News team purchased a train ticket with cash in a suburban Maryland town two weeks ago. No representative asked for identification or screened carry-on bags, nor were there visible signs of security.
After boarding the train and placing a backpack overhead, the team began its journey with other commuters toward the nation's capital. The bag contained books, a cell phone and notepads, but no explosives.
After getting off the train two stops later, the backpack was left behind in plain view. Two ABC News producers stayed to watch the bag, as well as people's reactions. No one noticed the unattended backpack — neither passengers nor conductors.
It traveled 45 minutes, through six stations to Washington, D.C.
"If a terrorist wants to put a bomb on a train, they probably have about a 99 percent chance of success," said Randall Larsen, founder and chief executive officer of Homeland Security Associates.
During another test on a Virginia commuter rail line several weeks ago, security officers with a bomb-sniffing dog walked past the abandoned backpack, but only after it had been on board for 30 minutes.
This week, on an Amtrak train from Washington, D.C., another backpack placed by ABC News traveled two and a half hours, all the way into New York City's Penn Station.
A top Homeland Security official says the tests by ABC News made him uneasy.
"It just confirms your fears that there are vulnerabilities in our system," said Asa Hutchinson, undersecretary for border and transportation security at the Department of Homeland Security.
Since the Madrid train bombing in March, the U.S. government has been trying to improve train security by testing ways to screen passengers and issuing new guidelines for rail protection. The attack taught security officials several important lessons.
The first lesson: The bombers exposed the vulnerability of commuter rail with an alarmingly simple plan.
On March 11, the terrorists placed small backpacks filled with dynamite on four trains bound for Madrid.
The bombs were wired to cell phones which set off the explosions when their internal alarm clocks went off, simultaneously, at the height of the rush hour.
"Everything would suggest these people had some kind of previous training on how to use explosives and how to maximize lethality," said Fernando Reinares, anti-terrorism adviser to the Spanish Interior Ministry.
The bombs were set to explode just as the trains were arriving on crowded platforms at the Atocha Station, but the trains were a few seconds late that morning. Had they been on time, police said, hundreds more would have been killed.
ABC News has learned the bombers met with senior al Qaeda operatives before the attack, but conceived, planned and financed it locally. The total cost was approximately $10,000, with a total planning time of a few months.
The second lesson: al Qaeda can still mount major attacks against the West despite losing bases in Afghanistan and much of its leadership.
"Today, there is a network of small- and medium-sized cells that often operate autonomously, which makes preventing attacks much more difficult," Alfredo Mantovano, undersecretary for public security at the Italian Interior Ministry, told an ABC News translator in Italian.