Since more than 250 people were killed in coordinated terrorist attacks in Sri Lanka on Easter Sunday, thousands of security forces have fanned out across the country in a massive operation intended to neutralize the ongoing threat of another attack.

Late Friday, at least 15 people, including six children, were killed in bomb blasts and a gun battle in the town of Sainthamaruthu, where police said a group tied to the Easter bombings was hiding out. In the past week, dozens of other people have been rounded up and arrested — including a wealthy spice trader whose two sons and daughter-in-law were allegedly among the suicide bombers who carried out the attacks.

On Friday, President Maithripala Sirisena said officials would restructure Sri Lanka’s security forces to try to better protect civilians, declaring the whole ordeal the result of a major intelligence failure. The country’s defense secretary and police chief resigned this week. Sirisena said they had been warned of the attacks but “did not say a word about this warning letter.”

“It was a serious lapse on their part and shirk of responsibility,” he said.

Underlying all these developments is a single, pressing question: Could the carnage have been stopped before it ever started?

It’s a question intelligence officials around the world grapple with in the aftermath of every deadly terrorist attack — from 9/11 to the Paris attacks, the Manchester Arena bombing and beyond.

“Any terrorist attack is by definition an intelligence failure,” said Raffaello Pantucci, director of international security studies at the Royal United Services Institute for Defense and Security Studies in London. “Intelligence’s job is to stay on top of these problems and stop them from happening.”

But experts say it’s much easier in hindsight to understand what was a crucial piece of information and to see that security forces should have acted on it. On a daily basis, intelligence officials “may be getting swamped” with tips and warnings, said Seth Jones, a terrorism expert at the Center for Strategic and International Studies.

It can be difficult to separate “which is most important and which isn’t,” he said. “People make mistakes.”

After the 9/11 attacks, the United States launched the National Counterterrorism Center in an effort to close intelligence gaps and ensure incoming information was being appropriately processed. In 2016, months after deadly terrorist attacks rocked Paris, French lawmakers urged a similar solution, suggesting leaders merge France’s intelligence agencies to ensure stronger monitoring of potential terrorists. Last year, British lawmakers determined that British intelligence failed to recognize the level of danger posed by Salman Abedi, the bomber who killed 22 people at an Ariana Grande concert. “[A]s a result of the failings, potential opportunities to prevent [the bombing] were missed,” lawmakers said.

There is no doubt that the attacks in Sri Lanka were also an intelligence failure, Pantucci said. But it’s a good sign, he noted, that officials were at least familiar with the local group, National Thowheed Jamaath, that they say was responsible for the attacks. That they were able to quickly make a number of arrests signals they at least had some individuals on their radar before the attacks occurred. The Islamic State has also claimed responsibility for the attacks, but it’s not entirely clear what role it may have played.

“It would be worse if someone launched an attack and we’d never heard of him and never heard of the group because then what are our security services doing?” Pantucci said.

Still, details about just how much officials knew remain murky. It’s been widely reported that India offered specific intelligence warnings about the attack weeks ahead of time and that officials still did not act. Whether that was the result of skepticism, incompetence or other obstacles remains to be seen.

“Sometimes, we have a name and concerns about an individual and the possibility of an attack but not a date,” Jones said. “What is surprising here is that there appears to have been a lot of information.”

As officials have rounded up individuals believed to be linked to the attacks, they will have to sort through new layers of information to figure out how this happened — and how the next attack can be stopped.

“If an attack was able to get through, you missed something, and you missed something big,” Pantucci said. “If you missed something big, what else is out there that you also missed?”

Read more: