In all reality, the only real limits for terrorists to attack these locations comes down to their desire to carry out the attack and their accessibility to the types of materials they need for the attack — whether it's for a bomb of some sort or another high-impact weapon. It's a low-cost task with a high impact.
One encouraging note, say experts, is that the kinds of things that help prevent attacks on hard targets will help at least a bit with soft ones--border security, surveillance cameras, confidential informants, and so on. Those safeguards probably wouldn't have helped prevent the Boston Marathon bombings, but they could conceivably forestall other attacks on targets, hard or soft.
The idea is to prevent those who could do harm long before they load up a pressure cooker with an improvised explosive device. Experts also point to the importance of making sure that mental-health services are available and to encourage mental-health professionals to come forward if they think their patients are a danger to themselves and others. No system of attack prevention is flawless, of course. But a quilt of different solutions can help. Unfortunately, while there are expensive but relatively simple solutions for preventing hijackers from ramming a plane into a building--more security guards, hardened cockpit doors, air marshals--the idea of distinguishing a troubled adolescent from a troubled adolescent killer can't be solved by hiring a few more TSA agents.
"The government can never guarantee 100 percent security," said Rick Nelson, a senior affiliate at the Center for Strategic and International Studies. "And even if they could, we wouldn't want to pay the cost both in terms of dollars and in the erosion of civil liberties."
Where local authorities can make the most difference happens right after an attack takes places, using surveillance technology, social media monitoring, or even license plate readers to catch suspects.
"Not everything is a technology solution, but there is a lot of great technology can be applied that can give you a better sense of situational awareness," Liscouski said. "You may not be able to prevent the incident, but you can certainly enhance the response rate to limit the amount of damage."
But for many locations, the resources aren't there. A security officer at a mall being paid $10 per hour cannot properly respond to a terrorist attack. The burden of the cost of boosting security for these soft targets falls on the owners of the locations, whether it's a stadium or a movie theatre. For example, the real estate group that owns a mall would have to invest heavily in security. And until there's a mall bombing at a mall, the likelihood this investment would take place across the country is remote.
At its root, one way to detect and stop an attack, Nelson explains, is simple and for those in Washington well-known: If you see something, say something. Homeland Security officials consistently say that everyday Americans should continue to stay vigilant and aware of their surroundings.
"Every individual, every American has a role in this, a responsibility," Nelson said. "If you are aware of suspicious packages or know first aid, those type of skills are critically important to building a developing a resilient society that can overcome these kinds of events more quickly."
The news surrounding the Boston bombings will fade, and Liscouski warns this will be the time when an attack will be most likely.