You say the word “Nairobi” and the place sounds just about as far away as it is. But if you look at pictures and plans of its Westgate Shopping Mall, where terrorists slaughtered 67 people last September and wounded 200, you feel like you’ve been there before in many cities in America, and many times. There’s the multiple levels built around an open atrium, the glistening escalators, the cafés, the boutiques selling jewelry, shoes and clothes. There’s the department store, the gadget shops.

A mall is a mall is a mall, and as we head to the ones in the United States en masse this Christmas season, the lessons learned from the slaughter in Nairobi are haunting the police and private security companies all over America.

It was just so damned easy for the killers in Kenya to do their job. There were only four of them and it appears very likely they escaped alive.

That’s the conclusion of a confidential report being presented today to private security personnel in the New York area by the NYPD. The author of the presentation, a veteran on the force who spoke to me on condition that I not use his name, warns that the example of Nairobi “is simple, its effective and easy to copy.” And that’s especially true in the United States where almost anybody can buy a “long gun”—a rifle or an assault-style rifle—with few or no background checks.

Take away the exotic foreign names for the terrorists’ organization, Al Shabab; strip away the politics of radical Islam. As the veteran cop puts it, from a law enforcement point of view, the main considerations are practical: “You don’t need to know the political philosophy of someone shooting at you with an AK-47. You want to know how many bullets he’s got in there. You want to know what he is carrying, and what kind of tactics he’s using.”

So the New York City Police Department sent two detectives to Nairobi when the three-day siege at the Westgate Mall was still going on. And while the text of the report issued today is based on publicly available information, including two detailed Kenyan television documentaries compiled from the mall’s closed circuit television footage, the detectives were able to corroborate and cross-check vital information. (You can watch the Kenyan reports here and here, but be warned, the footage is very graphic.)

The four shooters arrived in front of the mall at about 12:30 in the afternoon on Saturday, September 21. Two of them entered through the front. They tossed a couple of grenades at unarmed security personnel, and another one into the lunchtime crowd at the popular Art Café. Two other killers went around the back, up onto a rooftop parking lot where they shot men, women and children at a cooking contest under a temporary tent. An unexploded grenade was found at the scene afterward. If it had gone off, still more would have died.

But the shooters did not have many such explosives. There were no improvised devices set up as booby traps to kill first responders, as there had been when terrorists attacked hotels in Mumbai in 2008. In Nairobi “they were traveling light,” says the author of the NYPD report. Their main weapons were their Kalashnikov-style rifles, and it appears they never fired them on full automatic like a machine gun. They took one or two or three shots at a time. They conserved their ammunition. They probably carried only about 320 rounds altogether.

A few minutes after the attack started, the two on the rooftop parking lot entered the mall through the door there.

Now the slaughter really began in earnest. The terrorists had no interest in taking hostages. Their purpose was to kill as many people as possible, although in some cases they asked their victims if they were Muslims, and could name the mother of the Prophet Mohammed. Some of those who knew the name, Aminah, were allowed to go free.

The security guards at Westgate had no guns. But Nairobi is a dangerous city in any case and there are a lot of people—private security personnel and private citizens—who carry pistols. In the first minutes of the attack, many of them managed to help people escape from the mall, and some squeezed off a few rounds at the attackers. At that point one of the Shabab shooters wearing a black coat was wounded in the leg.

But as police arrived in force, they couldn’t tell the good guys from the bad guys. There were just a lot of men without badges or any other identification waving guns in different corners of the mall. And the confusion about who was shooting at whom and why grew steadily worse. The well-trained Kenyan SWAT team was closing in on the attackers when the Kenyan military arrived and shot two members of the police unit, killing its commander.

Many of the civilians in the mall had been too scared to try to escape out the exits if, indeed, they knew where those were. Instead they hid in shops, under tables, behind counters, in storerooms. And those are the places where the shooters looked for them and where they killed them.

Then, while the world watched satellite news feeds about the carnage, and listened to Kenyan officials giving contradictory and largely fictional accounts of what was happening—there were not 10 or 15 attackers, there were only four; they were not taking hostages, they were just killing people—the shooters calmly installed themselves in a storage room of the Walmart-style department store that had an exit to a loading dock and the outside world.

CCTV footage shows the shooters gave first aid to the member of the team in the black coat who had been wounded. They prayed with no particular urgency. They put down their weapons as if they felt no special threat. And a little after midnight, just 12 hours or so after the attack began, one of them reached up to the CCTV camera that had been recording their activities in the store room and turned it away so it could see no more.

It is likely that at that point the shooters made their way out of the building. The Kenyan military, which had taken charge, had set up a fairly loose perimeter. There were no soldiers inside the mall at that point, while those outside had no night vision equipment. No available CCTV footage shows the shooters anywhere inside or outside the building after about 12:10 a.m. Sunday morning. But the so-called “siege” continued for another two days. During that time Kenyan soldiers were filmed helping themselves to bags of groceries—perhaps as benign as bottles of water—in the supermarket, and the jewelry stores and other establishments appear to have been looted, although not on camera.

The crisis was only declared at an end after the Kenyan military had blown up a large section of the shopping mall, perhaps by accident. The construction standards were not especially high, and if the soldiers used their rocket propelled grenades or 84mm recoilless rifles in the basement they could have brought the whole thing down.

The lessons to be learned from all this already are, to some extent, standard procedure at many shopping centers, and have been for years. The vast Mall of America in Minnesota, for instance, stages regular drills and shutdowns. Private security personnel and local police forces in the United States are in much better positions than the Kenyans to react quickly and aggressively against any attackers. They have radios, at least. Mall management will use the public address system.

Yet we’ve already seen many incidents of lone, crazed gunmen in the United States attacking random targets, including malls, with incredible ease. Six people died and Congresswoman Gabrielle Gifford took a bullet to the head in the parking lot of a Tucson supermarket in 2011. Twelve people died when a madman opened fire at a multiplex cinema in Colorado in 2012. Just last month at the Garden State Plaza mall in New Jersey a shooter squeezed off a few rounds inside from “a weapon modified to look like an AK-47 assault rifle” before taking his own life. His sole interest, it seems, was suicide, but if he’d wanted to kill others, he certainly could have. And he was just one man with a gun.

The really bad guys, Al Qaeda and its acolytes, see the potential. While most cops may not be focused on the bigger ideological threat, counterterror operatives are looking at a world that appears more frightening every day.

“The threat is broader, deeper and longer than it was on September 12, 2001,” says one of the grand old men of the American counterterror wars, speaking on background. “The number of [Al Qaeda] alliances has grown enormously; the number of adherents to the global jihad has expanded enormously.” He cited the growing ranks of extremist fighters in Syria, in Yemen and across Africa from Somalia (the Shabab) to Nigeria (Boko Haram).

“The amount of territory they have for training has increased exponentially compared to what they had in a little corner of Afghanistan in 2001,” says the old operative. “Everybody likes to say that the head of Al Qaeda has been chopped off because Osama bin Laden was killed. But how important was he anyway? Ayman Zawahiri [Al Qaeda’s chief ideologue and now its top man] is still there. By any measure you want to count, the threat is more ominous now than at any time in the past dozen years.”

Let’s hope the old operative is wrong. But as we go to the mall this Christmas season, let’s stay alert. Law enforcement officials, having spent much of the last decade obsessed with the idea that terrorists would acquire weapons of mass destruction, are coming to the realization that, as one put it, WMD “has a freakout effect,” if people think they’re being gassed or facing a threat from radiation, but conventional firearms in the hands of well-trained, disciplined shooters are “more simple, direct and effective.”

At the end of the day, these days, terror’s just another word for a few guys with guns.