Survivors of the Sousse massacre told The Telegraph they had no knowledge of the previous suicide bomb attack on tourists and were horrified that security was so lax on the beach and at the Riu Imperial Marhaba hotel where Rezgui went on the rampage.
His shooting spree lasted about 25 minutes before he is thought to have run out of ammunition. He was then killed by Tunisian police.
Sources have told this newspaper that Rezgui was in possession of just four clips of ammunition for his AK-74 rifle, 120 bullets in all, suggesting he had become an expert shooter while at training camps in Libya.
Rita Williams, 76, who had a miraculous escape when a bullet tore through her straw sun hat, grazing her scalp, said she was astonished that security was not tighter, given the previous suicide attack on a stretch of sand six miles along the same beach.
"We never knew there had been a suicide bombing in Sousse," said Mrs Williams, from Maesteg in Wales. "We didn't expect any trouble when we booked. The holiday companies didn't tells us anything at all.
"We didn't notice any security on the beach. We never noticed any police in the two weeks we were out there."
Mrs Williams and her husband Ken were on their way back to the hotel next door to the Riu Imperial Marhaba Hotel when the shooting began; the bullet fired by Rezgui passing through her hat, leaving her with headaches for two days.
Anita Whitehead, who fled for her life with her husband Glenn, said they had seen just two police officers patrolling the beach in the five days they had been at the resort, in contrast to the more visible presence of officers when they stayed at the same resort last year.
Mrs Whitehead, 49, from Swanley, Kent, said: "On the day of the attack we saw a couple of policemen on horses and they were the first we'd seen since we got to the hotel. But last year we had seen the police on patrol every day."
News of the 2013 suicide bomber came as a complete surprise to Mrs Whitehead. Before travelling out to Tunisia this time, she had contacted Thomson, with whom she booked the holiday, to ask it about the security situation in Sousse and was reassured by the tour operator that it was safe.
"I told them that I had read about possible threats and I told them where we were going. They said it was fine. They reassured us and we thought we'd be safe," she said.
Tunisia's president, Beji Caid Essebsi, declared a state of emergency yesterday. It was not immediately clear why or what it would entail.
But the possible connection between Rezgui and Khalil will reinforce growing evidence that Rezgui, far from being a "lone wolf", was part of a sophisticated cell that had planned the attack.
Both Khalil and Rezgui are thought to have been recruited by Ansar al-Sharia, which was founded by Saifallah Ben Hassine, who had lived in the UK in the 1990s and whose mentor was Abu Qatada, the infamous hate preacher who lived in west London until his deportation to Jordan.
Tunisian police were claiming that Hassine personally plotted Rezgui's attack from his base in Libya. Most security experts have dismissed this, pointing out Rezgui's attack bore all the hallmarks of a plot hatched by Islamic State of Iraq and the Levant (Isil) affiliates. Hassine is said to have died in a US airstrike on his base in Libya a fortnight before Rezgui's killing spree.
Both Rezgui and Khalil are thought to have arrived at the beach, a glorious stretch of pristine sand that stretches several miles from Sousse to El Kantaoui, through alleyways that run between the numerous hotels.
In 2013, Khalil had been refused entry through the main entrance of the Riadh Palms hotel and instead walked along a path to the beach. He was confronted by security, and while sprinting towards the rear entrance of the hotel in the direction of tourists had prematurely triggered his suicide vest.
Local reports suggested the bomb was detonated by a mobile phone, suggesting Khalil had accomplices.
On the day Khalil blew himself up, five other people were arrested in Sousse on suspicion of planning similar attacks, and another suicide bomber was arrested in Monastir for targeting the mausoleum of a former president.
Suicide bomber strikes at Tunisia tourist resort
Alleged accomplices of Rezgui have also been rounded up in the past few days. Evidence against them comes in part from a mobile telephone that Rezgui was allegedly using and which he discarded by throwing into the sea as he embarked on his killing spree.
Reports suggested Rezgui made a 10-second call on a Samsung Galaxy at 11.53am to an accomplice living in a jihadist neighbourhood in Tunis. The call is thought to have been made by Rezgui to confirm he was embarking on his mission.
An analysis of jihadist attacks in Tunisia after the Arab spring in 2011 shows an escalation in attacks, which will fuel concern that British tourists were not fully aware of the risks of holidaying there.
Olivier Guitta, a terrorism expert, said he had uncovered evidence of 50 terrorist attacks in Tunisia since 2013 and found reports of seven terror training camps in the country.
In most of the incidents, jihadists had fought security forces away from tourist areas although there were notable exceptions, not least the murder of 23 people, including 19 tourists, at the Bardo National Museum in Tunis on March 18 this year. One Briton was killed, along with four Italians and three French citizens.
Mr Guitta, managing director of GlobalStrat, a security consultancy, said Tunisia had failed to put in place proper protection, and it did not have the resources to guard all its beaches and all its resorts.
He said: "Tunisian President Béji Caïd Essebsi said that he was surprised by the bloodiest terrorist attack in the history of his country. The attack that killed 38 people should definitely not have been a surprise. Since the 2011 Jasmine Revolution, Tunisia has had to face a huge security problem and numerous red flags were raised in the past few months."
In May, an armed group in Tunisia which has claimed allegiance to Isil tweeted a warning to western tourists not to go there for their holidays. It said it was aimed at countries in the coalition against Isil in Iraq and Syria.
"To the Christians planning their summer vacations in Tunisia, we cant accept u in our land while your jets keep killing our Muslim Brothers in Iraq & Sham [sic]," it said. Sham is the word usually translated as "the Levant".
"But if u insist on coming then beware because we are planning for u something that will make you forget #Bardoattack." Official tourism figures show that the numbers of French, Italian and German holidaymakers visiting Tunisia have dropped dramatically since the Arab Spring, from 2,250,000 in 2009 to just 731,000 in 2014.
In the same period, the numbers of British visitors actually rose from 275,000 in 2009 to almost 400,000 last year. After the Bardo attacks, it is thought numbers of French and Italian visitors dropped even more alarmingly, and there have been claims that the Tunisian tourism ministry pursued British customers to take up the slack.
One legal expert said it might be possible for injured victims and the relatives of those killed to bring a legal action in England against the tour operators.
Clare Campbell, travel litigation partner at the solicitors' firm Leigh Day, said: "If there was no security on the beach and there had been a previous incident in that locality and they did not react quickly enough, then all these questions need to be answered. It would be an interesting legal battle."
Suzy Makin, whose daughter Ellie, 22, from Ripon, North Yorks, was also caught up in the attack on the Marhaba hotel, called for tour operators to be more open with customers about the potential dangers of certain countries.
Ellie Makin had told her parents security had been "token" and unarmed guards had fled the scene. Mrs Makin said: "I'm absolutely horrified that nobody told us there had been a suicide bomber at the same resort. We should have been made far more aware that there was a potential threat to the area.
"Ellie told us she'd asked the travel agent if Sousse was safe and they had said it was. We had no reason as parents to think she might be in any danger."
Chris Evans, the Labour MP for Islwyn, who announced that Trudy Jones, a 51-year-old mother-of-four from his constituency, had been among the 30 Britons killed in Sousse, said he was "deeply concerned" about the lack of proper safety advice for travellers.
Mr Evans said: "Tour operators need to make travellers aware of these potential problems if they are selling tickets to these destinations. Most people assume that these places are safe if the tour operators are promoting them."
TUI, the travel conglomerate that owns Thomson, the tour operator, and the Imperial Marhaba hotel, has confirmed that 33 of the fatal victims of the attack were its customers, including all 30 Britons who had booked through Thomson and First Choice, which is also owned by TUI.
A Thomson spokesman said the company had stepped up security in the wake of the Bardo museum attack in March and that at all times it followed Foreign Office travel advice, which did not prohibit travel to Tunisia.
"We work on Foreign Office advice and that remained unchanged," said a spokesman.
The Foreign Office travel advice to Tunisia after the Bardo attack stated: "There is a high threat from terrorism, including kidnapping. Attacks could be indiscriminate, including in places visited by foreigners.... Further attacks are possible."
- Daily Telegraph
