It doesn't take a firearm or a bomb to wreak havoc. All it takes is a driver's license, a valid credit card, some proof of insurance - and as little as $19.
The attack on a riverfront bike path in Manhattan was carried out with a pickup truck that home contractors or do-it-yourself handymen can get with no background check and little worry it will raise red flags among law enforcement.
Eight people were killed and 12 seriously injured in the Tuesday afternoon attack when, authorities say, Sayfullo Saipov, a 29-year-old from Uzbekistan, barreled along the path for more than a dozen blocks.
Angela Hrdlicka, a former Secret Service agent who is now a private security consultant, said for the attackers, the rentals are a perfect recipe to carry out attacks: easy to get, cheap and with virtually no vetting.
"It's easy to do and it's very, very difficult to defend against," she said.
Home Depot officials said in an email to The Associated Press that it does not screen renters. All of its stores require a valid driver's license, insurance information and a credit card deposit. Other rental companies, including Hertz, Enterprise and U-Haul, mention similar guidelines on their websites. In most cases, the cost to rent a truck from Home Depot or U-Haul is much cheaper than a rental car.
Matthew Harrigan, a Home Depot spokesman, said there's no thought at this time to change how the company vets people who rent their vehicles.
John Miller, deputy commissioner for New York City Police, said Wednesday that authorities are working to put together a timeline of Saipov's whereabouts leading up to the attack.
New York City has a program called "Project Shield" in which law enforcement works with businesses to help identify potential threats. It wasn't immediately known if the store where Saipov rented the vehicle had been one of visited by authorities. So far in this case, Miller said, "there was certainly nothing unusual enough to cause anybody to call."
Vehicles have been used in scores of terror attacks around the world, including the July 2016 attack in Nice, France, when a large cargo truck drove into a crowd on a promenade. Eighty-six people were killed. In March, a Hyundai sedan rammed into a crowd on Westminster Bridge in London, killing five.
In the United States, terrorists used a Ryder van to detonate a bomb at the World Trade Center in 1993. And in 1995, a rented Ryder truck was used by Timothy McVeigh and Terry Nichols in the Oklahoma City bombing that killed 168.
"It doesn't have to be a big vehicle," Hrdlicka said. "You can mow down just as many people almost with a minivan and a crowd like that. If you started making them do background checks on rental vehicles they could just steal one or borrow their neighbors or use their own personal vehicle. That's not going to fix the potential risk."
Anthony Schilling, an adjunct professor of homeland security at the University of New Hampshire who's been involved in security since the 1970s, called it the nightmare scenario in a lone wolf attack. Vehicles are easy to rent and aren't subject to deep background investigations. "Even if you have a record, you can still rent a vehicle."
Bruce Alexander, a security and terrorism expert, said the World Trade Center and Oklahoma City bombings proved decades ago how easy it is to use these vehicles for destructive purposes. Those attacks helped raise awareness about the easy ways one can "weaponize" commonly available tools. But there's always a balancing act.
Companies want to ensure the customer's experience is as easy and simple as possible, and that vetting of customers is time- and cost-effective.
"It is very difficult to come up with a workable cost-effective model that also fits within the constraints of civil liberties and is also practical from a business standpoint," Alexander said.