U.S. intelligence and law enforcement agencies track thousands of potential threats each year to major public gatherings, ranging from the president's inauguration to football's Super Bowl. Those events are regarded as easier to safeguard because spectators must pass through checkpoints before gaining entry to a controlled space.
The Boston Marathon, by contrast, is a snaking 26.2-mile course lined by open parks, sidewalks and buildings. The Boston Police Department conducted two bomb sweeps in advance of the race, but there was little to prevent two brothers from blending into the crowd with homemade devices in their backpacks.
"This is a type of target that is unrealistic to expect to be secured," said Daniel Byman, a terrorism expert at Georgetown University and former CIA analyst. Protecting a single venue, Byman said, only means the list of remaining vulnerable sites is "infinity minus one."
Efforts to protect such targets have been ramped up over the past decade, but the bulk of the security measures adopted after the Sept. 11 attacks have been aimed at guarding against more catastrophic scenarios.
New agencies, including the Department of Homeland Security and the National Counterterrorism Center, were established to identify threats, generate terrorism watch lists and mobilize resources. Vast areas of the nation's infrastructure, including its shipping ports, have been shored up to prevent dangerous materials, such as radiological or chemical weapons, from slipping into the United States.
But security cannot be guaranteed in even the most heavily fortified areas, including aviation. Twice over the past 12 years, terrorists with ties to al-Qaida have boarded airplanes with hidden explosives. Layers of airport security and surveillance failed to stop them. Both cases might have ended in disaster if the bombers hadn't struggled to ignite their devices before being subdued by other passengers.