WASHINGTON – The Sept. 11, 2001, attacks led to a massive buildup of security to make the country safe. Subsequent plots, including attempts to conceal bombs in shoes and underwear, prompted hasty additions to that edifice, as officials sought to fill in cracks that terrorists might exploit.

The bombings at the Boston Marathon, suspected of having been carried out by two young men who immigrated to this country about a decade ago, are likely to yield a more frustrating security postmortem.

So far, there have been no calls for a major addition to the nation’s counterterrorism infrastructure, in part because it is difficult to identify a realistic measure that might have prevented the attacks.

Instead, U.S. officials and counterterrorism experts said that, while the bombings may lead to incremental changes in efforts to secure such events, they exposed the limits of the extraordinary defenses erected over the past 12 years.

The United States has spent billions of dollars on counterterrorism efforts during that span, an investment that has accomplished much of its aim. Overseas operations have pushed al-Qaida to the brink of collapse, and domestic steps have dramatically reduced the country’s exposure to an attack of the scale and sophistication of Sept. 11.

But the Boston bombings highlighted a lingering vulnerability that officials consider impractical, if not impossible, to eliminate. It centers on small-scale plots carried out by individuals who are unlikely to surface on federal radar. They rely on devices made from common ingredients like gunpowder, nails and a pressure cooker. They target public gatherings where security resources are stretched.

“There’s just no way to secure many large public events, and the kind of intrusive steps we would have to take are ones that no one would be willing to endure,” said Rep. Adam Schiff, a former federal prosecutor and member of the House Intelligence Committee. “We’ve always known the limits of what we could do in a free society . . . we saw those limits in all their horror (last week).”

National security and civil rights analysts said the U.S. government’s response to the Boston bombings will depend on details that emerge from the ongoing investigation, specifically whether the brothers accused of carrying out the attacks had direct connections to a foreign terrorist organization, were inspired by the ideology of radical Islam or had other motivations.

The two men, Dzhokhar Tsarnaev and Tamerlan Tsarnaev, were immigrants who had been in the United States for roughly a decade. They were part of a family with ties to Chechnya, a volatile region where Muslim separatists have been engaged in a bloody campaign against the Russian government for decades.

If there are connections to Islamist militant groups, including help planning and carrying out the attack, the Obama administration could expand intelligence-gathering efforts overseas, as well as widen surveillance and screening measures in the U.S. But such measures would likely be controversial and far from foolproof.

If, however, the Tsarnaev brothers carried out the bombings with no foreign assistance, the administration’s policy options may be more limited.

National security and legal experts note that the U.S. has endured violence committed with the kind of relatively small-size explosive devices used by the accused brothers for decades, attacks carried out by radical groups with ideologies that span the political spectrum.

Benjamin Wittes, a senior fellow at the Brookings Institution who tracks counterterrorism policy and law, said the administration would have to move carefully if it sought to expand surveillance in public spaces or increase monitoring of Muslim communities.

It’s a “scenario in which you are almost powerless in a policy matter,” Wittes said. “You obviously have to begin thinking about additional security at marathons and other events. But just as school shootings are really hard to prevent . . . I really don’t think there’s much more to do from a policy aspect.”

U.S. intelligence and law enforcement agencies track thousands of potential threats each year to major public gatherings, ranging from the president’s inauguration to football’s Super Bowl. Those events are regarded as easier to safeguard because spectators must pass through checkpoints before gaining entry to a controlled space.

The Boston Marathon, by contrast, is a snaking 42-km course lined by open parks, sidewalks and buildings. The Boston Police Department conducted two bomb sweeps in advance of the race, but there was little to prevent two brothers from blending into the crowd with homemade devices in their backpacks.

“This is a type of target that is unrealistic to expect to be secured,” said Daniel Byman, a terrorism expert at Georgetown University and former CIA analyst. Protecting a single venue, Byman said, only means the list of remaining vulnerable sites is “infinity minus one.”

Efforts to protect such targets have been ramped up over the past decade, but the bulk of the security measures adopted after the 9/11 attacks have been aimed at guarding against more catastrophic scenarios.

New agencies, including the Department of Homeland Security and the National Counterterrorism Center, were established to identify threats, generate terrorism watch lists and mobilize resources. Vast areas of the nation’s infrastructure, including its shipping ports, have been shored up to prevent dangerous materials, such as radiological or chemical weapons, from slipping into the country.

But security cannot be guaranteed in even the most heavily fortified areas, including aviation. Twice over the past 12 years, terrorists with ties to al-Qaida have boarded airplanes with hidden explosives. Layers of airport security and surveillance failed to stop them. Both cases might have ended in disaster if the bombers hadn’t struggled to ignite their devices before being subdued by other passengers.

The Boston bombings were reminiscent of another recent near-miss, the failed attempt in 2010 by a Pakistani-American to ignite a bomb hidden in a car in Times Square. Faisal Shahzad had lit the fuse on a device that also involved a pressure cooker. A nearby food vendor noticed smoke and alerted authorities, and Shahzad was apprehended after boarding a plane bound for Dubai.

Boston was far from defenseless as the marathon got under way. Among major U.S. cities, only New York and Washington have been under more stringent security since the Sept. 11 attacks.

Boston has used federal grants to help assemble a surveillance network that employs hundreds of cameras across the city and throughout its subways. Those cameras, along with images captured by private video systems and spectators’ cellphones, helped authorities identify the Tsarnaev brothers as suspects — but only after three people had been killed and more than 170 others injured.

Schiff said the bombings may trigger new debate over whether surveillance systems such as Boston’s should be expanded, whether spy agencies should focus more resources on regions such as Chechnya and whether the United States needs to examine how it integrates disaffected immigrants.

“We’ve had a lot of successes in degrading the ability of al-Qaida to launch massive attacks, but we’ve had a proliferation of one-off, foreign-born plots and self-radicalized individuals,” Schiff said. Ultimately, he said, “we’re going to have to recognize a certain vulnerability, and adopt a determined view that we will go on as we have, taking prudent precautions, but not changing the way we live.”