Paul Cruickshank is an analyst on terrorism for CNN and the co-author of "Agent Storm: My Life Inside al Qaeda and the CIA." The opinions expressed in this commentary are solely those of the author.

(CNN) As UK security services investigate what led Salman Abedi, a 22-year-old-British national of Libyan descent, to carry out the deadliest attack on British soil since the London bombings, a key line of inquiry will be what he got up to during the three weeks he spent in Libya before the attack.

UK Home Secretary Amber Rudd stated on Wednesday that Abedi had been on the radar of the British security services and had recently returned to the UK from Libya. US officials told CNN's Barbara Starr that Abedi came back just days before the attack.

British intelligence services are now trying to answer a series of urgent questions, including whether Abedi had any contact with terrorist operatives while in Libya and whether he received any bomb-making training while he was there. A British counterterrorism official told CNN on Tuesday evening that British intelligence services had not yet uncovered evidence of such ties, but cautioned it was very early in the investigation.

Investigators will be careful not to jump to conclusions. After the 2013 Boston bombings, there was a great deal of speculation that one of the bombers, Tamerlan Tsarnaev, had received bomb-making instruction in Dagestan on a visit before the attack. No credible evidence has emerged that he met with any terrorist group while there and investigators concluded that he built his device by downloading instructions from the internet.

Abedi's travel is being scrutinized because recent intelligence obtained by the US suggests that ISIS has set up an external operations wing in Libya tasked with plotting attacks in Europe. The group has already used Libyan soil to train recruits for attacks in Tunisia