In the aftermath of Friday’s Bourke Street terror attack, many Australians will be asking why the Australian Security Intelligence Organisation and the Australian Federal Police weren’t watching murderer Hassan Khalif Shire Ali.

Some Australians are no doubt bewildered that the authorities had cancelled Ali’s passport three years earlier on suspicion he was travelling to fight in a foreign conflict, but weren’t surveilling him 24/7.

Others will be wondering why Ali wasn’t a priority counterterrorism target given he had familial links with the group arrested for the 2016 Federation Square terror plot.

So why wasn’t Ali being monitored?

Without perfect foresight, ASIO and the AFP need to use more conventional and resource-intensive methods of monitoring counterterrorism targets.

This is a difficult task given that the Australian government is currently managing more than 400 high-risk onshore counterterrorism targets. To maintain continuous 24-hour physical surveillance on one of these target requires at least 12 staff. To physically surveil all of the top-400 priority targets 24/7 would require more than 4,800 staff on any given day.

Let’s not forget that even our security officials need days off, and on occasions get sick, so the AFP and ASIO would collectively require closer to 6,000 surveillance officers to manage the task.

Of course, ASIO and the AFP could use hi-tech surveillance capabilities like tracking and listening devices. However, that sort of equipment still needs to be monitored 24/7. So arguably they’d need at least 1,200 staff per day to keep track of the top-400 priority targets.

The point here is that it’s simply not possible to continuously monitor Australia’s top counterterrorism targets, let alone the thousands of other persons of interest who are linked to them. So ASIO and the AFP must prioritise their efforts, based on assessments of the capability and intent of each target to undertake an attack.

Recent terrorist attacks, like that in Bourke Street, reveal that would-be terrorists don’t need to have sophisticated capabilities to maim and murder. And contemporary research shows that a person’s intent to undertake an attack can rapidly change. So assessing the risk presented by each target is not an easy task.

Following Ali’s passport cancellation, both the AFP and ASIO would have undertaken a risk assessment.

The AFP would have sought to find evidence that Ali was planning an attack. It appears that there was no evidence to indicate that he was.

ASIO would have been looking for intelligence to suggest that Ali was a threat. Again, it would appear that there was no available information to suggest that he was of intelligence concern.

Just because someone is suspected of wanting to fight in a conflict in the Middle East doesn’t necessarily mean they’ll try a terrorist attack in Australia. Authorities have cancelled more than 240 Australian passports of suspected foreign fighters in recent years; few have been later implicated in terror plots.

It would appear that Ali was not assessed as a high risk in terms of his capability or intent to undertake a terror attack.

Ali’s alleged estrangement from his family, use of illicit drugs, and recent separation from his wife did indicate a troubling decline in his personal circumstances. Neither ASIO nor the AFP has the resources to monitor changes in personal circumstances for the thousands of counterterrorism persons of interest. It is here where those close to Ali—his family, friends or iman—may have made all the difference. However, to be fair, it’s always easy to second guess after the fact.

The public should rest assured that over the coming weeks and months the AFP and ASIO will be reviewing the decisions made with respect to Ali’s case management. They’ll be trying to determine whether they missed anything, or if there are systemic weaknesses in their risk-management approach. This will be cold comfort to the victims of this cowardly attack.

However, we should be very cautious about rapidly introducing any new counterterrorism measures in response to a single incident. On numerous occasions, ASIO’s director-general, Duncan Lewis, has gone to great lengths to reiterate that the national terrorism threat level remains at ‘probable’. And he cannot provide complete assurances that he can stop all attacks.

But the news isn’t all bleak. We should take heart that Australia has enjoyed great success in disrupting attacks, though the threat remains. The Bourke Street attack has proven that our police and emergency service personnel are up to the task. And those managing these capabilities continue to have them prepositioned to respond to incidents within minutes.