"Reddit gets it right" proclaimed the top post on the thread on Reddit, one of the world's most-read sites. The cause for self-congratulation? Getting the names of the suspects in the Boston marathon bombing right, of course.

Hang on, what's this? You say that the men chased by Boston police were brothers with a different surname? Reddit got it wrong? But everyone knows that the internet is better at whatever it turns its hands to than traditional whatevers. Media? We've got Twitter. Law enforcement? We've got Anonymous.

The idea that Reddit and 4chan, another gigantic site, could figure out not only who of the many attendees at the Boston Marathon was a suspect, but also name them, seems to have spawned very early on out of a laudable sense of civic duty.

Unfortunately, there was only ever the tiniest chance that it would work out, and far more chance that it would go horribly wrong – as it did. Between them, the two forums wrongly identified a number of people, picking them out from photos taken on the day ("those look like black backpack straps… he seems to be straining to hold it as though it's heavy…"), pinning names to faces in some cases, and leaving the innocents involved fearful for their lives.

The internet breeds this sort of overconfidence because when it's done right, crowdsourcing can be so effective. Done right, it's a fantastic use of what Clay Shirky calls "cognitive surplus" – a souped-up phrase for "time when we don't have something better to do".

Cognitive surplus has given us Wikipedia, written by thousands of people who might have done nothing more than correct a grammatical error or insert a fact, yet have created a towering resource. It's given us GalaxyZoo, in which non-expert users have classified hundreds of galaxies so that professional astronomers don't have to and can figure out how they evolve.

In his book, Shirky also points to an example where someone has their phone stolen, and recovers it through the action of the crowd, who help to identify the person it has ended up with. But even there some of the ugliness of the mob is visible; people like to take vigilante action where they think that situations are cut and dried.

Because the trouble is that when it comes to law enforcement, it's really easy to get it wrong through crowdsourcing. Though Anonymous wouldn't like to admit it, the examples where it has been a thunderous success in exposing wrongdoing and wrongdoers are few and far between, and those where it has simply caused trouble far more numerous.

Because when we get down to it, what can 4chan and Reddit bring to the task of finding suspects that the police and FBI can't? Only that cognitive surplus. But even there they are limited by the data they've got access to: public pictures and databases. Yes, everyone likes to think that with just a few pictures and a determined set to their jaw they could achieve what Mikael Blomquist does in The Girl With The Dragon Tattoo, and track down a killer based on a few photos from a fair (and getting together with the awesome woman hacker as a bonus).

But look for a minute at what the police and FBI bring to the fight. They actually get to the crime scene; they have forensics experts who know all about explosives; they get access to all the CCTV footage from the surroundings; they get access to all the mobile phone data from the area. The latter is useful if you think a bomb has been triggered by a mobile phone call, because you can identify the bomb: as "Ralf", an anonymous cryptanalyst explained soon after the blasts, "IEDs [improvised explosive devices] should leave a detectable signature in [mobile phone] provider logs. Fixed position for multiple hours. No incoming/outgoing calls/messages, then one incoming message, and drops off network without IMSI detach."

Find the bomb, find the phone that called the bomb, find where the call was made from – and see if you have CCTV footage to match that – and you start to narrow the search dramatically. As it happens, the FBI said that they suspected one of the bombers did make such a call before the first blast.

It's police work: hard, painstaking, but the best done by the experts. Crowdsourcing has its limits – and this week Reddit and 4chan demonstrated it very effectively. But next time there's an incident like this – which, let's hope, won't be for a long time – please, let's leave it to the pros.