This really is frightening.

Terrorist incidents tell us nothing new about human nature. We already knew that people are capable of horrendous violence, especially when they have come to regard some other subset of human beings as unworthy of full human status. It’s not surprising, then, to see the terrorists of Somalia’s loathsome al-Shabaab movement violating all laws of humanity by slaughtering innocent victims of all ages. People can become monsters, and they did in the Nairobi mall attack that began on September 21.

What really is alarming, though, is to see terrorists create a radical new tactic against which there is no obvious response or defense. There was nothing surprising, for instance, in the idea that terrorists might hijack airliners, but only in 2001 did we realize that hijackers might use them for suicide attacks, turning those aircraft into deadly missiles. Nairobi has just shown us another horrible innovation. It might be that we won’t realize how effective this could be against the U.S. until we face yet another day when we are counting the dead in their hundreds. We have to confront this issue immediately.

Think about it. How would one attack a shopping mall, whether in Nairobi or Minneapolis? Presumably a number of pickup trucks draw up in the parking lot, and 20 or so armed men and women get out, carrying their weapons and ammunition. Then they enter the mall and begin killing until they can do no more harm. They are strictly limited by the number of bullets and grenades they can carry. When police and military forces arrive, the terrorists might hold out for an hour or two before being eliminated.

That’s one way to do it, but it’s clearly not what happened in Nairobi, where firefights were still in progress several days after the initial assault. Even more amazing, terrorists were still putting up resistance against strong Kenyan forces, reputedly trained and assisted by British and Israeli special forces.

How on earth did the terrorists do it? Why, they rented a store.

They rented a store.

Several months before the attack, possibly a year, they rented a property in Nairobi’s Westgate mall and began a business. All the while, they were using the property to store huge quantities of ammunition, explosives, and grenades. When the terrorists eventually arrived for the deadly day, they already had a fully equipped arsenal on the premises. And they had spent months learning all the mall’s vulnerabilities, all the best places to set ambushes. It’s nothing short of brilliant.

The tactic must also be gravely worrying for U.S. agencies that have to be thinking very hard about whether—or when—it could happen here. Is there a giant mall in Los Angeles or Minneapolis or Washington, D.C. where some ordinary-looking people took out a lease last year and then ran it quietly and inoffensively, attracting little attention? And where, in the interim, they have been preparing an arsenal in preparation for some key day when shoppers show up in droves?

Assume this is true, that such a plot might be in the works in this country or in Western Europe. How on earth could it be prevented? Airline hijackings can be prevented, or at least limited, by stringent security precautions and searches. But preventing a prospective mall attack like I am describing? No, there’s no point in beginning background checks on every new business owner in America, not least because the people signing the leases would have squeaky-clean records. Nor, obviously, would focusing on Middle Eastern names or foreign citizens be at all useful in spotting the likely terrorists. While this is still controversial, at least some of the al-Shabaab death squads in Nairobi were white, and several were British or U.S. citizens.

The only possible form of pre-emption I can see involves sophisticated intelligence and surveillance.

If we are not very careful indeed, then some year soon, the phrase “Black Friday” could have a whole different meaning.