“It could be a coincidence, but it is difficult to believe that someone who shared the ideology of ISIS and says he is acting in the name of ISIS would just be using the same modus operandi, just by chance. I don’t believe it,” says Claude Moniquet, a longtime agent for France’s external intelligence service DGSE, who now runs a private intelligence company in Brussels. “He was clearly planning to do the same kind of thing” as the Bataclan, Moniquet told TIME on Monday. “Because it works.”

Moniquet says the ISIS playbook for such attacks breaks up the operation into three distinct phases: An initial phase of mass shooting, “to kill as many people as possible before the arrival of security forces;” a second phase of retrenching with hostages while waiting for the police to arrive; and a final phase involving a shootout with security forces. “That was clearly the ISIS guidelines since 2014,” he says. “We know that is what they teach in their training camps.”

Indeed, French police uncovered that tactic months before the Paris attacks. Last August, they arrested a young Parisian, Reda Hame, shortly after he had returned home from a week’s combat training with ISIS in Raqqa, Syria. Hame told them that the group had instructed him to open fire in a crowded music club or auditorium: A location where hundreds of targets would be grouped together tightly, unarmed and off guard. Three months later, that exact attack unfolded in the packed auditorium of the Bataclan.