It's hard to imagine a softer target than an enclosed, easy-to-enter space with large numbers of civilians, many of them children or elderly, milling about with no authority clearly in charge.
And the Al-Shabaab terrorist group that carried out this weekend's mall attack in Kenya is known to have recruited in the United States.
If you connect those dots, you get the kind of scenario that "keeps us up at night," as a federal law enforcement source told CNN's Pamela Brown: an attack at a shopping mall in the United States.
Can it happen here? Yes, say security experts, but it hasn't.
There have been shootings at U.S. malls, although not by terrorists. And there have been terror plots that were foiled.
But the United States has not witnessed anything close to the scope of the violent siege at Nairobi's Westgate mall.
There, the standoff continued Monday morning, two days after Al-Shabaab gunmen barged in and sprayed gunfire, killing at least 62 people and injuring more than 175.
Three of the alleged attackers lived in the United States. According to sources within Al-Shabaab, two lived in Minnesota and one in Missouri. And they are all in their 20s.
A senior U.S. State Department official says they're still trying to match the names, but they're becoming more confident that American citizens may have been involved.
It would not take too much sophistication to try a similar attack here, the official who spoke to Pamela Brown said.
"The worst case scenario is a bunch of these kids coming back, buying weapons in the United States some place like Minneapolis or Chicago and going after one of our malls here," Bob Baer, CNN's national security analyst, said Sunday. "They are indefensible especially with a well-trained group. There's nothing you can do about it. And I guarantee you that the FBI is going to be on it today."
In the past few years, federal prosecutors say they have thwarted two planned attacks on malls, each of which would have been carried out by single attacker:
--Nuradin M. Abdi, a Somali citizen living in Columbus, Ohio, was sentenced in 2007 to 10 years in prison after admitting he sought terrorist training in Ethiopia to carry out attacks, including a never-attempted attack on a mall in 2002.
--Derrick Shareef of Rockford, Ill., was sentenced in 2008 to 35 years in prison after pleading guilty to plotting to set off grenades at a Rockford shopping mall. Shareef was a convert to Islam who was recorded saying he wanted to kill "infidels."
But attacks which have succeeded in causing casualties at American malls in recent years have been carried out by young lone gunmen with no apparent cause to promote:
--A 19-year-old man killed eight people and then himself at an Omaha, Neb., mall in December 2007.
--An 18-year-old man killed five people before he was killed by police at a mall in Salt Lake City, Utah, in February 2007.
--A 22-year-old man killed two people and then himself at a mall near Portland, Ore., in December 2012.
"Soft targets always attract the terrorists because they're usually not defended," said Lt. Col. Rick Francona, CNN's military analyst. "It's a very effective way of causing a lot of panic, a lot of damage very quickly and achieving the objective of terrorizing people."