With perhaps ten or more dead in St. Petersburg in what looks like a terrorist attack on a metro station there, the questions are starting to mount. Is it really terrorism, or was there some other reason for the violence? If it is terrorism, who did the attack, and why this target? Is this an isolated event, or the beginning of a large campaign? These and other questions make the list long, but the queries after each attack are also familiar: Americans asked similar questions after attacks in Orlando and San Bernadino, and Europeans after violence in Paris, Berlin, and London.

Horror and confusion mark the hours and days after a terrorist attack. At such a time, little can, or frankly should, be done to minimize the horror and associated outrage. The resulting confusion, however, often exacerbates the fear, and sorting fact from fiction is difficult as the media race to uncover details following an attack and social media explodes with speculation. When a sniper killed five police officers at a peaceful rally protesting police violence, authorities initially feared there were multiple attackers. Some jihadist plots initially labeled “Lone Wolf” attacks in fact involved links to an array of Islamic State figures, while in others the Islamic State role was at first exaggerated. Initial media reports form a lasting impression that is hard to shake and has a long-term impact on public attitudes and public policy. Years after the 9/11 attacks, people would still ask me about reports of Al Qaeda financing itself by selling blood diamonds from Africa or the wave of follow-on attacks it planned—even though the 9/11 Commission and other investigations gave definitive accounts that discredited these initial reports.

In the hope of mitigating some of this confusion in the future, here are nine questions to ask after a terrorist attack. They are admittedly the questions Americans, not Russians, should ask, the law and institutions being very different here. Some of them would be the same, some a bit different for people in other countries facing days like yesterday:

Is there another attack coming? One of the top concerns for security officials after an attack is determining whether another one is imminent. Many attackers blow themselves up, are shot by police, or otherwise killed in the terrorist attack itself. However, in some cases the perpetrators remain at large, as in Paris in 2015 and the Boston marathon bombing in 2013. In other cases, a group might plan multiple attacks in which a number of cells are active in a variety of locations. This fear of another attack can lead officials to shut down cities, cancel flights, or implement other broad security measures. Understandably, law enforcement will err on the side of safety in the face of uncertainty. Does the attack itself involve only one person or a small number of individuals, or was its execution tied to a larger terrorist organization? Too often, there is confusion about an individual’s links to a broader terrorist group. Part of the problem is that the indicators are often confusing. A public pledge of allegiance to a group like the Islamic State may appear to suggest some connection, but anyone can declare support without having even met an Islamic State recruiter, let alone having trained and fought with the group in Syria. The San Bernardino attackers, for example, pledged loyalty on Facebook after the attack—a pledge the media quickly trumpeted—but which, according to the FBI, did not actually imply significant ties to the group. (The Islamic State itself further muddied the waters by claiming the attackers as “soldiers of the Caliphate.”) One key indicator is whether the group has a pre-attack video of the perpetrator in which he pledges his loyalty, as this suggests prior contact and at least some degree of direction. In general, links should be thought of as a spectrum: on one end, you have loners like Omar Mateen, who killed 49 at the Pulse nightclub and who seemed to have little true connection to the Islamic State as an organization. On the other end are the 2015 Paris attackers, who were directed by the Islamic State and had numerous links to the group. Many attacks in the West, however, fall somewhere in between. New York Times reporter Rukhmini Callimachi published an excellent article describing the range of connections various European terrorists, often labeled as lone actors, had to the Islamic State. These connections often include social media or other virtual connections that give the group some ability to direct the individual but often preclude training or other important forms of support. Were the attackers part of a larger network? A plot itself may be narrowly conceived of and executed by a few people, but the individuals involved may have been part of a broader milieu. Timothy McVeigh, the Oklahoma City bomber, flitted in and out of a pro-gun survivalist community, strengthening his hatred of the government. Al Qaeda, in particular, used training camps and propaganda to bring militants of all stripes together even when they were not under the group’s direct control. Some radicals meet in prison. Discovering and disrupting such networks and dangerous environments is often more vital for counterterrorism than stopping a particular cell or group that emerged from it. Is there a foreign link? And, relatedly, whether and to what extent the attack is domestic or foreign in origin? Different investigative authorities apply, and different bureaucracies weigh in depending on the level of foreign involvement. In addition, the counterterrorism implications vary dramatically if the group is based in Peoria instead of Pakistan. What is the role of foreign states? Too often the role of hostile or even allied governments is ignored when an attack occurs. Open sponsors of terrorism like Iran, of course, are well known, and when their proxy groups like the Lebanese Hizballah are involved, fingers quickly point to Tehran. Yet often, states play an important but more passive role: some states allow terrorist groups to raise money, travel with little interference, or generate propaganda with little impunity. Until recently, Turkey allowed foreign fighters to pass in and out of Syria, while several U.S. partners in the Gulf often failed to crack down on terrorist financing. What role did the community play? Terrorist violence rarely reflects the feelings of the broader community, but that does not mean the community plays no role. In the immediate aftermath of an attack, community support can make all the difference when seeking to rapidly identify and arrest the perpetrators and to determine how far out the circle of plotters goes.Communities are vital law enforcement allies, providing tips on potential attackers and passing on essential information should an attack occur. Fortunately, the United States has benefited from a Muslim community that cooperates readily with law enforcement. In Europe, the less-integrated Muslim communities are often more hostile to and hesitant to cooperate with the state. If Muslim-American perceptions of law enforcement or willingness to work with the government should shift, the result would be disastrous for counterterrorism. How does the attack fit into the overall level of violence? When terrorists strike, there is often a sense that violence is on the rise. But if we step back, the trends are often less clear. The United States has seen only 95 deaths from jihadist-linked terrorism since 9/11, a far smaller number than many experts expected. Europe has seen more deaths, but it also saw more deaths than the United States in the pre-9/11 era. The incidence of terrorism in Britain is illustrative. The March 2017 vehicle and stabbing attack in London, which killed four people, was the worst attack in Britain since the 2005 subway and bus bombings that killed 52 people. As tragic as the 2017 attack was, this gap in major attacks shows a remarkable degree of success: in the last 12 years, terrorism in Britain occurred far less frequently and was less deadly than many feared in 2005. In the interim, British security services arrested or disrupted numerous plots, suggesting that they are managing the threat well. As the British case demonstrates, new attacks should be put in a long-term context in order to avoid the perception/narrative of an inevitable rise in violence. What mistakes did government officials make? This may shock you, but your government is not perfect. It’s always tempting to get out the nooses after a high-profile attack, but often the inability to prevent an attack results from problems that are institutional, not individual. Investigations of the 2016 attacks in Brussels that killed 32 innocent people suggest that the intelligence failures were systematic, reflecting the country’s decentralized political structure, rather than simply a misjudgment by a few individuals. Once we have answers to the above questions, we can judge which agencies were most responsible, how leaders could have more effectively allocated resources, and reevaluate other core policy decisions. What new authorities or other changes are necessary in light of the attacks? Even if your government did make mistakes, changes aren’t necessarily in order. Almost every change comes with new costs and the potential for new mistakes. Tighter borders inhibit trade, greater information sharing poses privacy concerns, and so on. One counterterrorism failure in the post-9/11 era concerns resilience. Despite presidents warning that terrorist attacks are inevitable, we still expect perfection; London Mayor Sadiq Khan was harshly criticized after the latest attack for saying that terrorism is part of living in a major city—i.e. for acknowledging the obvious point that the risk of terrorism can never be zero. Such hopes for perfection can easily become the enemy of the good, especially when, so far at least, the U.S. homeland has not suffered a massive terrorist attack since 9/11.

The above list can act as a starting point, and each terrorist strike will come with its own unique set of issues. But if we begin asking these questions from the start, we’ll be better able to order the chaos and prepare for the next attack.