Can we stop bombs made from hardware store?

It couldn't have been too hard to put together: a few simple alarm clocks, gasoline, standard propane tanks, and common fireworks, plus several bags of garden-variety fertilizer. But law-enforcement officials say that if the improvised incendiary device left in Times Square had detonated, it could have caused a huge fireball and killed many people—although it would probably not have brought down any buildings. In fact, authorities say the device was quite primitive and unlikely to actually detonate.

But even a dud is scary. Is it possible to prevent low-tech attacks like this, which can be carried out with weapons made from regular consumer products? Not always. "There's nothing that's foolproof," says Juan Zarate, a senior adviser at the Center for Strategic and International Studies, who was deputy national-security adviser to President George W. Bush. "We shouldn't sugarcoat it." The good news is that improved security in public spaces, steps to take the most powerful weapons out of terrorists' reach, and a watchful public all can help lessen the impact.

A problem with standard intelligence methods is that they tend to do very little to stop single actors, or small groups that don't have outside connections. "When you've got that, combined with a low-tech attack, that becomes difficult as well, because the ingredients are found in normal commerce," says Zarate. There's simply too much information out there for law enforcement to monitor it all—and civil-liberties concerns complicate matters further. Brian Jenkins, a senior adviser at the RAND Corporation, points out that for all the jihadist attacks on American soil that have been thwarted since 9/11, the only two successful ones have been carried out by individuals acting alone: Maj. Nidal Hasan's shooting rampage at Fort Hood, and Abdulhakim Mujahid Muhammad's shooting at a Little Rock Army recruitment center, both in 2009.

An alternative is to focus on ingredients. Even though the materials are common, the behavior of buyers or the amounts they purchase often raise questions. The 1995 Oklahoma City bombing, for example, used thousands of pounds of explosive fertilizer (the Times Square bomb included fertilizer, but police say it was not explosive). When would-be New York subway bomber Najibullah Zazi was arrested in 2009, it emerged that he had frequently visited a beauty-supply store in Colorado, purchasing large quantities of acetone and hydrogen peroxide, which can be used to make explosives. Zazi told clerks, who were curious about his purchases, that he had "a lot of girlfriends." Although there was no tip in that case, police rely on merchants to report suspicious customers. But while such trip wires may catch attacks that rely on major quantities like the Oklahoma City or Zazi case, the Times Square bomb relied on comparatively small amounts of raw material. "You can't monitor everyone who buys a propane tank for the summer," Zarate says.

That means the best bet is to cut off attacks between creation and detonation. The first line of defence is police: dogs are highly effective in sniffing out explosives, although they can only cover so much ground, and cops can also keep an eye out for bombs (Iraqi police have deployed bomb-detecting wands, but experts widely deride the devices as worthless).

Deterrence helps, too—demonstrations of a strong presence of officers may dissuade would-be attackers from doing anything that might attract suspicion—but it has limitations. "To spend huge sums of money and invest vast numbers in terms of security personnel to protect public spaces isn't practical," Jenkins says. "And it would have an adverse affect on society—we'd be creating a neomedieval system of perimeters." Would-be terrorists might be pushed away from the softest targets, there would be no way to harden every possible public space. Besides, Times Square tends to be a heavily policed locale, and no one noticed the nervous-looking suspect who was captured on surveillance tapes, so it doesn't always work.

From there, it falls to alert bystanders. The vendor who spotted the smoking SUV in Times Square has already become a minor folk hero, but Zarate says alert civilians are an important element of preventing any number of terrorist attacks, not just low-tech ones. For example, it was fellow passengers who helped to foil the Christmas Day airplane "underpants bomber." And quick reaction by the vendor in the New York bomb allowed for an evacuation that might have mitigated the worst had the bomb exploded.

With so few effective tactics for preventing low-tech attacks, the major consolation is that these measures seem to have driven attackers away from more lethal explosive devices, which are more easily detected, and toward primitive incendiary devices, which are more likely to fail and less deadly. Even if the explosives in Times Square had worked, experts don't believe they would have been powerful enough to bring down a building. "They are hard to set off, so therefore, the progress has been that we have pushed people away from things that could cause immediate damage in the direction of things that are not likely to work as well," says Jenkins. "That is progress."