As investigators combed through evidence in the deadly Boston Marathon bombings, seeking both motive and perpetrator, we turned Tuesday to a security expert for guidance on how the investigation may be unfolding.
Bryan Cunningham, a former CIA officer, assistant U.S. attorney and deputy legal adviser for the National Security Council, served in both the Clinton and George W. Bush administrations. He is now a senior adviser at the consulting firm the Chertoff Group, co-founded by former Homeland Security Director Michael Chertoff.
NPR: What have investigators been doing to determine the source of the explosions?
Cunningham: "They're looking for any little pieces of wire and powder residue from the explosives, anything to help re-create the device. You can figure out the type of explosive. Was it gunpowder or fertilizer like Timothy McVeigh used in the Oklahoma City bombing that would suggest a less-sophisticated device? Or plastic explosives that suggest you're dealing with someone better trained and with access to more sophisticated materials?
"If they can recover parts of the device, there may be a fingerprint, or some DNA. It's unlikely, but it happens. After the first  trade center attack in New York City, they pieced together enough of the truck that exploded to identify it."
Once they have evidence of the type of device and explosives used, what might that tell them?
"Big time professional, international bomb-makers often have a signature — sometimes it's intentional and sometimes it may just be that they were trained a certain way. There are very extensive databases that contain information on these 'signatures,' and you can quickly determine if the device carries the signature of a bomb-maker in those databases. Obviously, you can have someone not in a database. It's not foolproof, but it's very helpful."
What else are they looking for that will provide clues as to whether this was an act of domestic or international terrorism?
"Obviously, national intelligence and law enforcement officials [will be] looking at all electronic communications in the last 30 to 60 days. They'll be searching for code words like 'marathon,' and 'Boston,' as well as heightened chatter. Were there people who knew about it overseas?
"The device signature will also be another really important clue. Historically, multiple devices detonated very close in time suggest that al-Qaida was involved. But early reports suggest that the devices appear to be relatively unsophisticated. They reportedly had nails and ball bearings in them — items you can get at any hardware store."
New reports have suggested that the explosives may have been contained in 6-liter metal pressure cookers filled with nails, ball bearings and shards of metal. How small could the receptacle containing explosives be to have caused the type of injuries inflicted Monday?
"It could very easily have been the size of a pipe bomb, just a foot or so long and certainly something small enough to be contained in a duffel bag. And there's enough fog out there, I wouldn't necessarily rule out that investigators don't have another [undetonated] device. There's been enough reporting on both sides of that. That detail is really something that the FBI doesn't want the bad guys to know."
There are also reports that an electronic circuit board that may have been part of a timer used to detonate the explosive was found at the site. But what other potential triggering devices might they be looking for?
"In trying to determine if the device was triggered by a cellphone, they can get phone records for hours leading up to the event. When looking for a bomb trigger, they can use analytical software to help rule out anything other than very short communications with another number that's no longer active."
How helpful might amateur photographs and videos taken near the marathon finish line before and after the explosions prove to be?
"This is one of the huge advantages we have today that we didn't have five or 10 years ago. That was one of the most photographed sites on the planet yesterday. Investigators will have access to surveillance video, police video, images from fixed cameras, data from automatic license plate readers, as well as everything the public turns in. The holy grail, of course, would be a photo or video of an individual planting the device. There is software that can analyze video and photo images."
What type of existing, ongoing official surveillance might investigators have access to?
"Domestically, we don't do the kind of blanket surveillance we can do overseas, and for legitimate issues of privacy rights. There will be a few domestic targets that the FBI will have probable cause to run surveillance on all the time, but it won't be many — not like we can do overseas. National agencies will also be looking at all the entries into the country over the last several months, although that can be pretty flawed, given the easy ways into the country from Canada and Mexico."
What reality might this type of attack suggest to investigators and homeland security officials going forward?
"The loss of life is terrible. The terror in Boston is terrible. And now you're ... going to have a lot more homegrown terrorists who can make something like this work. I'm afraid other people will try. You can't install a magnetometer every 10 feet for 26 miles."