Why terrorism threat levels rise in the days, weeks and months before an attack, not after. The risk level is determined by what we know, not what has just taken place. And what we know is usually determined in large part by intelligence.
Compare that with the 2010 G8/G20 disaster in Toronto where police cars were burned, bank windows were smashed and hundreds were arrested. The question raises itself: what was different this time in Canada?