Authorities say ISIS has made it to America.

Multiple news organizations reported Friday morning that Tashfeen Malik, one of the two shooters in Wednesday’s massacre in San Bernardino, California, pledged allegiance to Abu Bakr al-Baghdadi, the leader of ISIS, on Facebook in the midst of the attack.

Assuming the report holds true, it likely answers one central question about what motivated the attackers, Malik and her husband Syed Rizwan Farook: an allegiance to the fanatical Islamist group. But it raises many more questions. What does it mean for ISIS to take action in the United States? Is this different from other lone-wolf-style attacks in the United States? Who counts as part of ISIS? Did the couple have any material ties or instructions to the self-proclaimed Islamic State? And can attacks like this ever be stopped?

While the investigation is still in its early stages, officials said they didn't think that any ISIS leaders had instructed Farook and Malik to conduct the massacre, which killed 14. “At this point we believe they were more self-radicalized and inspired by the group than actually told to do the shooting,” a federal law-enforcement official told The New York Times.

That means this attack is different in kind from the Paris attacks. In that case, officials believe the killings were carefully orchestrated by Abdelhamid Abaaoud, a Belgian who had traveled to and from Syria at least twice, rising from foot soldier to leader in ISIS’s ranks. Even if Abaaoud’s planning was independent, he was in contact with leaders and seems to have returned to Europe with an eye toward conducting attacks there.

If Malik and Farook were acting on their own accord, it would perhaps provide some reassurance that American counterterrorism hadn’t missed communication that could have foretold the attack. The bleak side of that is that it’s very difficult to detect self-radicalizing individuals—even ones, like Malik and Farook, who had stockpiled thousands of rounds of ammunition.

As ISIS has lost physical ground in Iraq and seen its cities pounded by airstrikes, it has shifted its tactics away from controlling territory—that is, the actual work of being a state—and begun calling on sympathizers to launch attacks in Western countries. San Bernardino fits into that plea.

But if ISIS commanders weren’t involved in the planning, how is the San Bernardino attack different from other lone-wolf attacks in the United States conducted by people who professed fidelity to violent jihadism, even if they didn’t have any formal ties to established groups? The death toll in California was higher, but Americans have seen several of these attacks over the years: a foiled 2011 bomb plot in Manhattan, the Boston Marathon bombing, and a shooting at a military-recruitment center in Chattanooga earlier this year. It also includes borderline cases like Nidal Hasan, who opened fire at Fort Hood after exchanging emails with the radical preacher Anwar al-Awlaki, or Faisal Shahzad, who received training in Pakistan but appears to have planned a bomb plot in Times Square on his own.

For that matter, what does it mean to be a member of ISIS, especially if one hasn’t been to the Levant? This is where Malik’s pledge of allegiance seems significant. Al-Qaeda, the previous incumbent as the world’s most feared terrorist group, tends toward the bureaucratic. Earlier this year, the U.S. government released a document seized during the raid that killed Osama bin Laden—a reasonably extensive questionnaire for anyone interesting in applying for membership.

ISIS, by contrast, seems much more welcoming. The process for conversion to Islam is relatively simple: recitation of the shahada, generally with witnesses. To become a member of ISIS, or at least to act in ISIS’s name, seems to require little more than a statement of allegiance to Baghdadi, who has declared himself caliph. As close terrorism-watchers Thomas Joscelyn and Rukmini Callimachi both pointed out, ISIS has said people should swear allegiance before attacks. The swearing of allegiance—bay’ah in Arabic—is a long tradition. Early Muslims swore allegiance to Muhammad as their leader. (Some Muslim countries still employ the process formally, and political theorists have postulated that bay’ah justifies Islamic democracy, because it involves the consent of the governed to be led by a chosen ruler.)

The ease with which a would-be attacker can attach himself or herself to ISIS and then carry out an attack in the group’s name raises questions about how meaningful it is that the San Bernardino attack had connections to ISIS, as opposed to any other Islamist groups. But it also makes it very difficult to block attacks. Since the September 11 attacks, the U.S. has created massive new mechanisms to try to track terror suspects. The FBI has also specifically been watching ISIS sympathizers stateside, the Times reports:

In recent months, the F.B.I. has been particularly concerned about individuals inspired by the Islamic State staging attacks in the United States, law enforcement officials say. Even before the shootings and bombings in Paris last month, the agency had under heavy surveillance at least three dozen individuals who the authorities were concerned might commit violence in the group’s name.

Yet that dragnet still wasn’t able to catch Farook and Malik.

Critics of the U.S. reaction to the September 11 attacks see things like that and argue there’s a great risk in overreacting to terrorism. For one thing, one of the legally defined goals of terrorism is to affect government policy, so an overzealous response may be unwittingly acquiescing with the aims of attacks. Meanwhile, too extensive a dragnet produces such massive amounts of data that it’s hard to separate the real risks from the minor ones and focus resources where they’re best used. While it is little consolation to the victims in San Bernardino and their families, the odds of being killed in a terrorist attack in the United States remain very low. It’s tough see how a confirmed ISIS attack on American soil changes that math.