If a man walked into a drug store along one of this city's winding streets and bought three boxes of aspirin, there would be no reason to take notice. But when Anders Behring Breivik visited 20 drug stores a day for four days and bought three packages of aspirin at each stop _ then separately ordered six tons of fertilizer, chemicals and a semiautomatic rifle _ he still largely escaped attention.
Now, Breivik's massacre of 77 people in a meticulously planned rampage is forcing Norwegian authorities to look at what they could have done to prevent or identify his pattern of purchases and other suspect behavior. But figuring out how government should respond will present a tough test _ pushing up against laws protecting personal freedoms and the likelihood that, even with more forceful intelligence, an isolated and thorough plotter such as Breivik will remain exceeding difficult to stop.
Breivik says in his 1,518-page manifesto that he bought the aspirin to obtain acetylsalicylic acid, combined with other chemicals to build the truck bomb he planted in central Oslo. He was painstaking in arranging his purchases _ creating elaborate cover stories including renting a farm and documenting a plan to grow sugar beets _ to stay within both the law and the norms of doing business.
The Oslo attack has already spurred anti-terrorism officials at the European Union, consulting with counterparts in Norway, to look at ways to flag suspicious sales of legal chemicals, including fertilizer, that can be used to make explosives.
EU experts will discuss exactly how such a new system would work when they meet at a specially called conference in December, said Tim Jones, principal adviser to the EU's counterterrorism coordinator.
Meanwhile, Norwegian officials say they plan a thorough reexamination of laws and intelligence methods.
"Can we do something differently? We will do that with our sister agencies all over Europe. I'm certain that my colleagues want to talk to me about 'what can we do if we are in the same position," said Janne Kristiansen, director of the PST, Norway's national security agency.
What could be done differently is hardly a matter of consensus in this country of 4.9 million.
Domestic surveillance is an especially touchy subject in Norway, a country that prides itself on its transparency and dedication to protecting of civil liberties. In the mid-1990s, revelations that Norway's intelligence agencies had been spying illegally on Norwegians with suspected or stated Communist leanings sparked public outcry, Parliamentary hearings, a spate of resignations and ultimately an overhaul of the country's intelligence apparatus.
Norway agreed earlier this year to participate in EU counterterrorism initiative mandating that the government stores citizens' telecommunications for a fixed period of time _ six months in Norway _ after transmission.
Norway's Justice Minister, Knut Storberget has bemoaned surveillance limitations placed on Norwegian counterterrorism investigators.
Investigations "are frequently hampered because of the ever-growing limitations on what can be logged and how long that data can be stored," he told Norwegian news agency NTB at the time.
To the contrary, says Per Sandberg, who chairs the Justice Committee in Norway's Parliament.
"We've gone far enough already, looking into the private lives of Norwegians," said Sandberg, who is a member of the right-wing Progress Party.
The head of the commission that investigated the claims of politically motivated espionage in the '90s, Ketil Lund, told the AP that, like Sandberg, he believes widening the scope of surveillance beyond the EU's parameters is unlikely to gain much traction.
"After all, our state leaders have been talking so much about how this terrorist act should not lead to a more closed and less democratic society," the retired Norwegian Supreme Court justice said.
Rather than more windows into how Norwegians live, Sandberg says, PST needs more analysts and ought seek to develop still greater counterterrorism expertise by consulting countries with long histories of dealing with terrorism, like the U.S. and the U.K. Currently, about 460 people work at PST.
Norway's government has announced that it plans to form an independent commission to examine a host of issues, including policing matters, stemming from the July 22 attack.
Whatever comes out of that commission, the trick is to make it easier to catch this kind of person "without taking away the openness and liberties more than necessary," Kristiansen said.
That won't be easy.
"Acquiring of weapons or material would be one spot where you may be able to detect people before they do something because you need stuff, but then again you don't need lots," said Magnus Norell, a senior analyst at the Swedish Defense Research Agency focused on terrorism.
Breivik was well aware of the law and skilled at making sure he would not get caught.
In order to acquire a Glock pistol legally, he writes in his manifesto about attending 15 required training sessions from late 2010 to this past January. To obtain the enormous quantities of aspirin, he explains how he mapped out a route between 20 drug stores _ walking rather than driving because of the difficulty of finding parking in Oslo. Stores were supposed to limit him to buying only two boxes at a time, but he explained that he needed three for his company as an antidote to hangovers during upcoming holiday parties.
He also appears to have recognized when he was at risk of tripping intelligence wires. In an entry from this past March, he outlines his effort obtain aluminum powder _ intended as a component for the bomb _ from Polish supplier Keten Chemicals. It turns out Keten was being watched by Interpol, the international police agency based in France, which reported orders by 50-60 Norwegians to the country's intelligence officials. But Kristiansen's agency said that after looking into the list, the agency did not find any reason to pursue an investigation of Breivik.
"I regret placing the order as I see, in retrospect, that Keten is likely to be closely monitored by a majority of European intelligence agencies," Breivik writes.
Breivik's purchases, along with his postings on websites run by far-right extremists, beg the question of whether there might not been a way to foil his plot.
But the experience of the U.S. _ where domestic terrorist Timothy McVeigh killed 168 with a truck bomb crafted using the same chemical as Breivik _ showcases some of the challenges of tightening the net to prevent such acts.
After Oklahoma City attack in 1995, U.S. officials set out to prevent a similar attack. A committee chartered by the National Academy of Sciences recommended in 1998 that the government tightly regulate the sale of ammonium nitrate, the key ingredient in McVeigh's bomb and, apparently, in Breivik's.
But nearly 16 years after the bombing, the U.S. government is only now nearing imposition of such rules.
"What you're up against is the fact that ammonium nitrate is a major agricultural chemical," said Edward Arnett, a professor emeritus of chemistry at Duke University who co-chaired the committee that made the recommendation. "I think the various lobbies that represent agriculture didn't want to have anything stand in the way of buying it."
In late 2007, Congress finally passed a law requiring regulation of the chemical's sale. But the Homeland Security department missed its 2008 deadline to publish a final rule. Officials say they will post proposed regulations on sale and transfer of ammonium nitrate this week, after which the public will have 120 days to comment.
Meanwhile, in the decade since the September 11, 2001 terrorist attacks, the ability of computers to zero in on terrorists by mining reams advance substantially, said Bhavani Thuraisingham, director of the Cyber Security Research Center at the University of Texas at Dallas.
Programmers already have developed technology to detect suspicious links between networks of plotters. Now they are working to create programs capable of detecting outliers. Thuraisingham's fellow researchers are focused on putting that technology to work to spot constantly mutating computer codes deployed by hackers. But it could also be use to spot terrorists who don't fit the expected pattern _ like the blond-haired, blue-eyed loner in a jacket and tie, Breivik.
That search, though, would be greatly complicated in identifying someone who maintained no social networks, she said. And trying to build in privacy protections would make it exceedingly difficult, she said.
"It's not magic," Thuraisingham said of the technology. "If there's no data then all the best data mining algorithms you can produce will not produce any results."
Associated Press Writers Don Melvin in Brussels, Karl Ritter in Oslo and Eileen Sullivan in Washington contributed to this story.