As Russia observes a day of mourning for the victims of Friday’s terror attack, along with the sorrow comes the hard question that follows most similar incidents: how could this have happened? Rooting out determined and well-trained terrorist cells is not an easy task for security services in any country, but there are numerous signs that failing to prevent Friday’s attack was in large part down to a catastrophic security failure on the part of Russian authorities. First, there was the public warning from the US government earlier in March that it had learned of “imminent plans to target large gatherings in Moscow” by terrorists. The warning, also shared privately with the Russian government, suggested Washington had picked up some fairly specific intelligence relating to an upcoming attack. But Putin, three days before the attack, brushed off these warnings, calling them an “attempt to scare and intimidate our society”. In light of Putin’s public dismissal of the threat, it also seems Russian authorities did not take additional security measures to protect such large gatherings, with numerous witnesses talking of an extremely light security presence at the Crocus City Hall. The police response to the attacks was so slow that the handful of attackers were able to roam the venue at will, kill more than 100 people and then slip away without being apprehended or shot on the spot. For a country with a giant, sprawling security apparatus, this slow response is shocking. Some Russians pointedly compared the absent police response on Friday with the overwhelming police presence at the funeral of opposition leader Alexei Navalny, after his death in a Russian prison. “The FSB obviously had their priorities wrong. They had their main resources on Ukraine and on the domestic opposition. These are the priorities placed upon them from the top,” said Mark Galeotti, an expert on the Russian security services. As the crackdown on dissent has intensified in the two years since the full-scale invasion of Ukraine, Putin’s security services have gone after people who put likes on anti-war social media content, LGBTQ+ adolescents who can now be accused of “extremism” simply for attending gay club nights, and people laying flowers in memory of Navalny. Thousands of security officials have been sent away from their day jobs in Russia to manage the takeover of newly occupied parts of Ukraine, rounding up Ukrainian sympathisers and sowing terror in a foreign country rather than keeping an eye on security threats at home. There was also a feeling that the threat from domestic Islamist terrorism, ever-present during the first decade of Putin’s rule, had subsided. Strong-arm tactics in the North Caucasus region, combined with allowing several thousand radicals to leave for Syria and Iraq several years ago, led to a feeling that the fight against Islamist terror was over. “Everybody relaxed and there was a general feeling that there was no longer a serious threat,” said one analyst who works on the phenomenon inside Russia. The dynamics at play in Friday’s attack, with most of the perpetrators apparently radicalised citizens of Tajikistan, are different to the terror attacks in the early part of Putin’s rule, when attackers tended to be from the North Caucasus. Galeotti said: “Central Asian Islamic terrorism remains a real problem for the FSB. The FSB has a lot of experience dealing with extremists in the Caucasus, they have spent huge resources on that, but central Asia is more of a blind spot.” Predictably, in the aftermath of the attack, rumours and wild theories abounded about who might “really” have been responsible, even as Islamic State took responsibility for the bloodshed. Putin hinted at supposed Ukrainian links to the attacks, and Russian pro-war commentators went further, making a concerted effort to suggest that the Islamic State claims were a red herring and the attacks were actually organised by Kyiv. Ukraine has fiercely denied this. Meanwhile, Ukrainian military intelligence and some western commentators suggested the whole thing had been a “false flag” event, organised or facilitated by the Kremlin to consolidate the war effort in Ukraine. There is so far no evidence that either of these suggestions are true, although the coordinated claims of Ukrainian involvement by Russian sources do suggest that the Kremlin plans to use the aftermath of the attacks for political gain. The coming days will show whether the Kremlin’s claims of Ukrainian involvement are simply a distraction tactic from the intelligence failure, or if they will be used to bolster a ramping up of war rhetoric. In many societies, there would be serious political questions raised after such an attack, but Putin rarely punishes subordinates for failures and will likely be keen to avoid too much talk of an intelligence catastrophe. “You would think heads should roll at the FSB, but there was no meaningful retribution for their intelligence failures during the invasion of Ukraine. Putin is hesitant to implement a major reshuffle,” said Galeotti.