Susana Vera / Reuters

In 2004, near-simultaneous attacks on Madrid’s commuter train system killed 192 people and injured more than 2,000. Those attacks, blamed on al-Qaeda, remain the deadliest ever to have been carried out on European soil. They prompted Spanish authorities to reassess their internal-security posture—a process that involved hiring thousands of people whose job it was to stop another attack.

Over the next 13 years, as Islamist terrorists targeted cities across Europe—London, Paris, Brussels, Nice, and Manchester to name a few—some of them multiple times, Spain arrested 700 people, convicted dozens, imprisoned 120 people for terrorism-related offenses, and foiled many plots. Spain’s strategy seemed to work—until Thursday. That’s when a Morocco-born man struck pedestrians in Barcelona with a van, killing 14 people and injuring dozens of others.  Separately, police killed five suspects in Cambrils, a seaside resort near Barcelona, who struck seven people with a car. Authorities said the attacks were connected and the perpetrators had been planning larger-scale attacks, but were thwarted when their suspected bomb factory in the town of Alcanar exploded. ISIS claimed responsibility for Thursday’s attacks. But the key question is perhaps not so much why Spanish authorities couldn’t prevent them, but how Spain managed to avoid being a target for so long.  

El Pais, the Spanish newspaper, reported in June that more than 1,000 people were on the radar of Spanish police, 259 people were being investigated, and 500 telephones were being tapped in dozens of anti-terrorism investigations across the country. The newspaper reported that a silent “army” of more than 3,000 officers were working to prevent another attack. They sifted through social-media accounts, investigated mosques, and worked with informers to gain information and knowledge about terrorist networks. Their conclusion: a new attack was inevitable. In fact, El Pais noted that Madrid, Barcelona, Ceuta, and Melilla were considered particularly vulnerable, and reported that intelligence agencies had warned about “busy areas in Madrid and Barcelona” being attacked. Las Ramblas, the target of Thursday’s Barcelona attack, is perhaps the busiest pedestrian thoroughfare in the city, popular with tourists and locals alike.

Before the 2004 Madrid attacks, there were few hints of a potential problem with Islamist terrorism. As I reported yesterday, Spain has had a long history with terrorism, but much of the violence was carried out by ETA, the Basque separatist group, which declared a truce in 2011. Before the 2004 al-Qaeda attack, authorities had their eye on smaller Islamist groups that were operating in North Africa, as well as Salafist groups (which are not necessarily violent) that were slowly gaining followers—and which are influential in rural and coastal Catalonia.

“There are different currents” of Salafism, Lorenzo Vidino, the director of the Program on Extremism at George Washington University, told the Guardian. “There are currents there that are very conservative but not necessarily supporting violence. Having said that, it’s undeniable that that environment has created a milieu that is fertile for further radicalization. It explains why there is more radicalization than any other part of mainland Spain.”

Many Spaniards from this part of the country ended up fighting in the jihadist battles of the age. As El Pais pointed out:

Imad Eddin Barakat, known as Abu Dahdah, and one of the founders of Al Qaeda in Spain, would see off fighters from Madrid’s Barajas airport, sending them to join the jihad in Bosnia, Chechnya or Afghanistan. And he would welcome back the wounded, and send them off to be treated in state-funded hospitals in Spain. The Syrian-Spaniard was shepherding his flock with total immunity. No one foresaw that those bearded fighters who came back from combat zones had been trained in weapons and explosives, and could be a danger to our safety.

In recent years, the attention of Western security organizations has moved from watching for militants returning from Afghanistan, Bosnia, and Chechnya to the fighters coming back from Syria and Iraq. Spain hasn’t had the same numbers of citizens going to fight in those countries on the side of ISIS—and none of the suspects arrested in Spain are said to have known ties to terrorism. It’s not clear if authorities knew of those militants who were killed. Which points to several possible conclusions: Security officials may thwart dozens of terrorist plots, but they need fail just once; it’s virtually impossible to stop someone truly intent on attacking civilians, especially if (s)he is using a low-tech weapon such as a van; and the best responses to terrorist attacks are only good until the next attack.

We want to hear what you think about this article. Submit a letter to the editor or write to letters@theatlantic.com.