"Intelligence work is always difficult. But traditionally it has been looking at structured organizations," said Geoffrey O'Brian, the former director general of counterterrorism at CSIS.
"Whenever you have an organization and a structure, it's frankly easier to investigate than it is to investigate unconnected individuals who are acting out of a common motivation."
In an evening address on Wednesday, Prime Minister Stephen Harper said the shooting death of a Canadian soldier at the National War Memorial in downtown Ottawa and the fatal hit and run of another solider two days earlier in Quebec were "terrorist" acts.
90 people being monitored by RCMP
Information is still being gathered on Michael Zehaf-Bibeau, the suspect in the attack on Parliament HIll and the War Memorial. But Martin Couture-Rouleau, who waited in a parking lot for at least two hours before driving his car into two Canadian soldiers, was one of 90 people being monitored by the RCMP as part of 63 current national security investigations, the RCMP revealed.
"These aren't 90 people who meet every Tuesday night and you can log the names and take their pictures," O'Brian said.
Security and intelligence expert Wesley Wark said intelligence work is like triaging in a hospital's emergency room — you try to identify the top priority targets and put most of your resources on them.
Under its federal policing initiative, the RCMP has been engaged in redistributing the resources devoted to counterterrorism work but it's difficult to know the impact from the outside, he said.
But some security officials have also complained that limited resources are hampering investigations. Jeff Yaworski, deputy operations director at the Canadian Security Intelligence Service, recently told a Senate committee that CSIS has to “prioritize” its active monitoring of individuals who pose a potential threat.
“There’s nothing more that we can do with the budget that we have except to prioritize internally as effectively as we can and I think we’re doing that. Our success rate has been quite good . . . I’d be foolhardy to say we’ve got all the bases covered. We do what we can with the budget that we have.”
'Very labour intensive'
"The reality of course is,simply to put physical surveillance on someone for a long time is very labour intensive," added O'Brian.
However even with enough resources, police cannot make a move on someone unless they've clearly broken the law.
"The kind of attack that was conducted [by Couture-Rouleau], even if we had the surveillance car on his bumper , there’s nothing illegal to be parked in the parking lot, there’s nothing illegal to wait in your car, said former CSIS senior intelligence officer Michel Juneau-Katsuya.
Or, as RCMP Supt. Martine Fontain put it, it's not a crime in Canada to have radical thoughts.
"The courts have been clear, a thought is not enough, radical ideas isn’t enough. There needs to be evidence that people are looking to move to action," said Christian Leuprecht, an associate professor in the department of political studies at Queen’s University. "So that’s the standard of evidence the RCMP needs to meet."
Leuprecht pointed out that security agencies do have certain provisions in Canada's anti-terrorism legislation available to them, including provisions for preventive arrest, which means someone can be held without charge for up to three days just on suspicion of being involved in terrorism.
Officials could also use investigative hearings, in which someone suspected of having knowledge of a terrorist act can be forced to answer questions or be imprisoned for up to 12 months.
But so far, authorities have never used those measures against suspected extremists, the difficulty being that investigators must prove those suspects pose an imminent threat and a genuine risk to public safety, Leuprecht said.
In terms of security certificates — which allow suspects to be detained for years without charge — the courts have been very harsh, especially on CSIS, which has not provided enough concrete grounds to hold somebody once these certificates come up in court, Leuprecht said. "So there's been apprehension to use them."
"We luckily don't live in an authoritarian regime with a government that can monitor all our actions and movements and communications. It needs to have good grounds to interfere in individual lives. So that means every now and then, somebody, somewhere, somehow may slip through the cracks."