He didn't come out of nowhere. The Orlando shooter came under suspicion three full years ago, after boasting of mutual acquaintances with the Boston Marathon bombers and making statements to co-workers that suggested he had radical, violent intentions. But after a 10-month investigation the FBI closed the case, finding no criminal charge to pursue.

Omar Mateen was investigated again in 2014 as part of a separate probe into a suicide bomber who attended the same Florida mosque and was a casual acquaintance. Again, agents found no significant radical ties and shifted their focus away.

Did investigators miss something they should have seen? A look at how law enforcement makes these life-and-death judgments:

___

DOES THE GOVERNMENT BELIEVE IT SHOULD HAVE DONE ANYTHING DIFFERENTLY?

"So far, the honest answer is, I don't think so," FBI Director James Comey says. But he also says the FBI will keep examining its past actions.

Mateen's behavior and contacts were enough to prompt surveillance, the use of confidential informants and three direct interviews with him. But his was just part of a huge volume of investigations that has only grown in an era of prolific Islamic State propaganda and its advocacy of do-it-yourself terrorism.

President Barack Obama on Monday lamented the difficulty of tracking "lone wolves" who operate without ties to known terror groups. Comey said the FBI does "hundreds and hundreds" of investigations like the one Mateen faced.

Most conclude without any basis for arrest or further monitoring, and once that happens, there's no mechanism for keeping perpetual watch on those subjects — or preventing them from buying weapons. Mateen was added to a terror watch list when he came under investigation in 2013 but was removed once that matter was closed.

Discerning whether someone under scrutiny will commit violence, or even who should be scrutinized, is more than just finding the proverbial needle in a haystack, Comey said. "It's which pieces of hay are likely to become a needle."

HOW BIG IS THAT HAYSTACK, REALLY?

Obama said Monday it's a big problem when radical groups are promoting violence "very effectively over the internet." In the U.S., he said, "out of 300 million, there are going to be some individuals who find for whatever reason that kind of propaganda enticing."

___

WHAT'S THE PROTOCOL FOR FBI COUNTERTERROR INVESTIGATIONS?

Guidelines set by the attorney general spell out levels of investigation, each requiring specific layers of approval and permitting agents to use progressively more intrusive methods depending on the national security threat.

Mateen's 2013 examination was a preliminary investigation, which requires a supervisor's approval and can go on for six months, with an extension if warranted. Mateen's lasted 10 months before being closed. In a preliminary investigation, agents may track phone calls and obtain Internet communications and bank records. Investigators looking into Mateen's statements to co-workers used confidential informants, followed him and recorded his conversations.

"The evidence developed during the investigation was consistent with his explanation that he had said these things to try to freak out his co-workers," Comey said. Agents ultimately accepted that explanation.

More serious, longer-term terrorism cases can employ invasive techniques such as obtaining an order from the Foreign Intelligence Surveillance Court to conduct electronic surveillance and physical searches.

___

HOW OFTEN DO PEOPLE KNOWN TO THE FBI GO ON TO COMMIT VIOLENCE?

Not often, but it does happen. A notable example is Tamerlan Tsarnaev, who along with his younger brother carried out the 2013 Boston Marathon bombings. The FBI interviewed Tsarnaev and relatives in 2011 following a tip from a Russian intelligence security service that he was a follower of radical Islam. The FBI did not find any domestic or foreign terrorism activity.

More recently, Elton Simpson, one of the two men fatally shot during an attempted attack last year on a Prophet Muhammad cartoon contest in Garland, Texas, had previously been prosecuted in Arizona in a terrorism case. He was sentenced to probation for lying to a federal agent. But soon before the May 2015 violence, he came back onto the FBI's radar because of postings on social media.

___

DOES THE FBI KEEP TRACKING PEOPLE IT ONCE INVESTIGATED?

Investigations are commonly closed when agents conclude they have insufficient cause to keep them open. The FBI maintains records in case the name surfaces again in connection with another matter. But agents can't maintain surveillance without new evidence of wrongdoing.

People who were once looked at for potential terror ties can be removed from watch lists, buy weapons and generally resume their lives.

"Every case has to come to an end someplace, and if you don't have evidence that somebody commits a crime, then you're obligated to close that case," said David Gomez, former counterterrorism chief of the FBI's Seattle field office.