Belgium’s prime minister was contrite after the Islamic State’s deadly attack on one of world’s most important cities.

“We have to do more,” Prime Minister Charles Michel said, “and we have to do better.”

Those comments were made in November 2015 after ISIS, as the Islamic State is also known, attacked multiple locations in Paris, killing 130 people and wounding scores of others. On Tuesday, Michel made similar remarks after ISIS struck Brussels, killing more than 30 people and wounding 300 others.

“What we feared has happened,” he said. “We were hit by blind attacks.”

The terrorist group’s strike at the heart of Europe—Brussels is both the Belgian capital and where the EU has its headquarters—showcases not only its ability to conceive, plan, and execute attacks outside the Middle East, but also highlights the intelligence failures that allowed ISIS to carry out attacks in two European cities four months and 200 miles apart.

There were warning signs—several of them—before the Brussels attacks: Belgium has long been known as Europe’s hub for Islamist radicals. More Belgians have joined ISIS as a proportion of the population than have people from any other Western country. Many of the Paris attackers were Belgian nationals or residents. One particular Brussels neighborhood, Molenbeek, has come under scrutiny from counterterrorism officials as well as the media as the epicenter of Belgian jihadism. Another, Schaerbeek, where police raids in the aftermath of Tuesday’s attacks were carried out, will likely face similar scrutiny soon. Europol, the EU’s police agency, warned as far back as January that ISIS “special forces” had planned to target European cities in attacks like those on Mumbai, India, in 2008.

But in the aftermath of Tuesday’s attacks there appear to have been as many opportunities missed by Belgian intelligence agencies as there were chances to stop the carnage. Belgian officials have not explicitly connected the Brussels and Paris attacks, but there are enough commonalities—including the attackers’ activities in Brussels itself and the name of Najim Laachraoui, who authorities say was one of the suicide bombers that struck Brussels airport and who they say made suicide vests used in the Paris attacks. These commonalities indicate that had Paris been prevented, or its alleged logistical mastermind, Salah Abdeslam, caught sooner than last Friday, then an examination of the intelligence missteps that led to Tuesday’s events in Brussels may have been unnecessary.  

Although it might be tempting—and uncharitable—to attribute the attacks to Belgians’ love of “eating chocolate and enjoying life and looking like great democrats and liberals,” as one Israeli minister did, Tuesday’s attacks point to a far more systemic problem. Europe’s intelligence services—with the exception of Britain’s and to some extent France’s—have long been viewed skeptically by their counterparts elsewhere. Of these, Belgium is seen to have one of the weakest.

There are several reasons for this. Belgium, which my colleague David Graham described as “a fragile artificial creation, riven between French- and Flemish-speaking citizens,” not unlike the Middle East, has been described as “a nation without a state.” And like the Middle East—and unlike the Europe in which it sits—illegal weapons are readily available, a legacy of the conflict in the Balkans in the 1990s.

Belgium has a weak central government and several powerful local municipal entities that are often at odds with one other. This spawns a gigantic bureaucracy. The Brussels area, where 1 million people live, is governed by 19 municipalities and is served by six police forces, each of which answers to a different mayor. Their actions are often hampered by rules such as no police raids between 9 p.m. and 5 a.m.—rules that could politely be called comical.

The case of the Abdeslam brothers is a case in point. They’d been on the radar of at least one Belgian intelligence service as far back as July 2014. Another Belgian intelligence service, however, said it became aware of them only in January 2015—six months later. The brothers were among the terrorists who struck Paris on November 13, 2015, and one of them, Salah Abdeslam, is believed to have been the only survivor. Abdeslam spent the next few months on the run. Belgian authorities came close to capturing him once, two days after the Paris attacks, but couldn’t raid the apartment in Molenbeek in which he was believed to be holed up because of the restrictions on when police can carry out raids. By the time they made it to the apartment, Abdeslam was gone. When he was eventually captured last Friday, four months later, he’d been hiding under everybody’s noses: in Molenbeek.

After the Paris attacks, Committee P, a government agency that serves as the police watchdog, identified several “deficiencies and weaknesses” in how authorities handled information on the Paris attackers. RTBF, the Belgian state broadcaster, reported that the watchdog cited several reasons for the failure, including technological ones. “Certain IT problems were not resolved,” it said, according to RTBF, and the watchdog criticized a lack of “qualified personnel.” Another issue was one of information-sharing: a nom de guerre used by one of the Paris attackers featured in several Belgian police databases, but not in the central one, the watchdog said. Then there are more mundane—but possibly more serious—problems, including misspelled names in terrorism databases that prevent efficient information-sharing not only in Belgium, but across the EU. All of which leads to Tuesday and Brussels.

The Belgian federal prosecutor confirmed Friday what Belgian media had reported earlier this week: that Najim Laachraoui was one of the suicide bombers at Brussels airport. Laachraoui, a Belgian, was an associate of Abdeslam and is believed to have made suicide vests used in the Paris attacks. His DNA, and Abdeslam’s fingerprint, was found in a Brussels apartment in December. Belgian authorities asked the public for information about Laachraoui after Abdeslam’s arrest last Friday. It was too late. On Tuesday, he, along with another suicide bomber, blew himself up at Zaventem airport.

There appear to have been both general and specific warnings about the threat to Brussels itself. Haaretz reported that Belgian security services knew the airport would be targeted. On Wednesday, a Turkish official said Turkey had deported Ibrahim el-Bakraoui, who Belgian authorities say attacked the airport along with Laachraoui, to the Netherlands last year and had warned that he was a foreign fighter captured on Turkey’s border with Syria. Nevertheless, el-Bakraoui was released. So far, no one has lost his or her job. Justice Minister Koen Geens and Interior Minister Jan Jambon both turned in their resignations this week, but the prime minister declined their offers.

When asked who was to blame, Geens said: “It is clear it is not one single person, but it is true that we could have expected from Ankara or Istanbul a more diligent communication, we think, that perhaps could have avoided certain things.”

And he added: “Our own services should perhaps have been more critical about the place where the person had been detained. When someone is arrested there in a city few people know, it is clear enough for insiders that it could be a terrorist. Here, though, he was not known as a terrorist. It is the only moment we could have linked him to it. And that moment, perhaps, we missed.”

That missed moment—and the ones that preceded it—proved costly.